CVE-2026-80206: NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
The NLTK tgrep module accepts user-supplied regular expressions and passes them to the Python re engine without a timeout or validation, enabling catastrophic backtracking (ReDoS). Applications that expose the tgrep API to external input are vulnerable to a single-request denial of service that blocks the Python process indefinitely.
References
- github.com/advisories/GHSA-w3v8-gmh9-3wv7
- github.com/nltk/nltk/commit/0072ea2fb8be22e038a36e887b7061bb6b9339d9
- github.com/nltk/nltk/releases/tag/v3.10.3
- github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3751.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-80206
- www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrep
Code Behaviors & Features
Detect and mitigate CVE-2026-80206 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →