CVE-2026-80205— NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex

Quick assessment

Copy summary Copy citation

Affected

nltk nltk

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NLTK 3.10.0 之前的版本存在正则表达式拒绝服务漏洞，涉及 Text.findall() 和 TokenSearcher.findall() 方法。这些方法在接受用户提供的正则表达式时，未进行任何验证或设置超时机制。攻击者可以构造特定的正则表达式模式，引发灾难性回溯（catastrophic backtracking），从而导致 CPU 被无限占用，造成 Python 进程所有用户的服务拒绝（DoS）。

CVE-2026-80205 affects nltk nltk. No confirmed in-the-wild exploitation; assess based on exposure. NLTK 3.10.0 之前的版本存在正则表达式拒绝服务漏洞，涉及 Text.findall() 和 TokenSearcher.findall() 方法。这些方法在接受用户提供的正则表达式时，未进行任何验证或设置超时机制。攻击者可以构造特定的正则表达式模式，引发灾难性回溯（catastrophic backtracking），从而导致 CPU 被无限占用， CVE-2026-80205 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-80205

I. Basic Information for CVE-2026-80205

Affected Products

II. Public POCs for CVE-2026-80205

III. Intelligence Information for CVE-2026-80205

Other References for CVE-2026-80205 (2)

• 🔗 ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions · Advisory · nltk/nltk · GitHub Read full article vendor-advisory
• 🔗 NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex | Advisories | VulnCheck third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-80205

IV. Related Vulnerabilities

V. Comments for CVE-2026-80205