Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80206— NLTK 3.10.2 Regular Expression Denial of Service via tgrep

Quick assessment

Affected
nltk nltk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NLTK 3.10.3 之前的版本在 tgrep 模块中存在一个正则表达式拒绝服务（ReDoS）漏洞。_tgrep_node_action 函数会编译嵌入在 /regex/ 模式节点中的用户提供的正则表达式，并通过 re.search 在树节点标签上执行这些表达式，过程中未进行任何验证或设置超时限制。攻击者若控制 tgrep 模式（例如通过暴露给外部输入的 tgrep_positions() 或 tgrep_compile()），可提供能够触发灾难性回溯的正则表达式模式，导致 CPU 被无限期占满，从而阻塞 Pyt

CVSS 5.9 · Medium

Possible ATT&CK Techniques 1 AI

T1074 · Data Staged

Affected Version Matrix 2

VendorProduct Version RangeStatus
nltk nltk < 3.10.3 affected
3.10.3 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80206

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NLTK 3.10.2 Regular Expression Denial of Service via tgrep
Source: CVE Program / CVE List V5
Vulnerability Description
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1333
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nltk nltk 0 ~ 3.10.3 -

II. Public POCs for CVE-2026-80206

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80206

请登录查看更多情报信息。

Other References for CVE-2026-80206 (2)

IV. Related Vulnerabilities

Same product: nltk
Same vendor: nltk
Same weakness: CWE-1333

V. Comments for CVE-2026-80206

No comments yet

Leave a comment