What’s Vulnerable › Vulnerabilities

CVE-2026-81725: NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-27 · updated 2026-09-01
• Weakness: CWE-400

Description

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.

Affected products

• nltk: before 3.10.3 — fixed in 3.10.3

How to fix

Upgrade to a fixed version: nltk 3.10.3. Check the vendor advisory for mitigations.

References

• https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj
• https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusreader

Get alerted when CVE-2026-81725 or the next vulnerability affects your stack