CVE-2026-80206: NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
The NLTK tgrep module accepts user-supplied regular expressions and passes them to the Python re engine without a timeout or validation, enabling catastrophic backtracking (ReDoS). Applications that expose the tgrep API to external input are vulnerable to a single-request denial of service that blocks the Python process indefinitely.
References
- github.com/advisories/GHSA-w3v8-gmh9-3wv7
- github.com/nltk/nltk/commit/0072ea2fb8be22e038a36e887b7061bb6b9339d9
- github.com/nltk/nltk/releases/tag/v3.10.3
- github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3751.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-80206
- www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrep
Code Behaviors & Features
Detect and mitigate CVE-2026-80206 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →