Vulnerability Description
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nltk | Nltk | < 3.10.3 |
Related Weaknesses (CWE)
References
- https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqjExploitVendor Advisory
- https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-deniaThird Party Advisory
FAQ
What is CVE-2026-81725?
CVE-2026-81725 is a vulnerability with a CVSS score of 3.7 (LOW). NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with m...
How severe is CVE-2026-81725?
CVE-2026-81725 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-81725?
Check the references section above for vendor advisories and patch information. Affected products include: Nltk Nltk.