Skip to content
fr Sign in
6.3 Medium

CVE-2026-81725 NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows…

Description

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.

Affected products and versions

Product Affected versions Fixed in
nltk 3.10 earliest → < 3.10.3 3.10.3

References

Timeline

  1. Published
  2. Last modified

Other CVEs of nltk

The 36 CVEs of nltk →
CVE-2026-109956 NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass… 8.3 High CVE-2026-81727 NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and… 6.9 Medium CVE-2026-81726 NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by… 8.3 High CVE-2026-81724 NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct.FeatStructReader that allows… 6.9 Medium
Track this CVE