Vulnerability Description
NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nltk | Nltk | < 3.10.0 |
Related Weaknesses (CWE)
References
- https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55ExploitVendor Advisory
- https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-uThird Party Advisory
- http://www.openwall.com/lists/oss-security/2026/09/01/3
FAQ
What is CVE-2026-80205?
CVE-2026-80205 is a vulnerability with a CVSS score of 7.5 (HIGH). NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without val...
How severe is CVE-2026-80205?
CVE-2026-80205 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-80205?
Check the references section above for vendor advisories and patch information. Affected products include: Nltk Nltk.