CVE-2026-81725CWE-400denial-of-service

CVE-2026-81725

Low · published August 27, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
29.6
In the wild
Unconfirmed
What it is

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00369 · 29.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-27T21:21Z
Affected products (1)
ProductVersionsFixed in
nltk/nltk< 3.10.33.10.3
References (2)
https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj · [email protected]https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusreader · [email protected]
EPSS history
Timeline
  • 27 AUG 14:51Z
    NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader
    cvelistv5