CVE-2026-81725: NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
Pl196xCorpusReader still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs.
References
- github.com/advisories/GHSA-8mpw-7fpc-4gqj
- github.com/nltk/nltk/commit/7808692d451b962711005d954859bb83aabcf8fa
- github.com/nltk/nltk/releases/tag/v3.10.3
- github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3752.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-81725
- www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusreader
Code Behaviors & Features
Detect and mitigate CVE-2026-81725 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →