CVE-2026-80206

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.

• CWE-1333

• https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7Exploit, Vendor Advisory
• https://www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrepThird Party Advisory
• https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7Exploit, Vendor Advisory

Published

Aug 26, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-80200Kimai before 2.53.0 contains an open redirect vulnerability …4.7
• CVE-2026-80201Kimai before 2.53.0 fails to block sensitive User methods in…2
• CVE-2026-80202Kimai before 2.56.0 does not enforce team-membership checks …8.8
• CVE-2026-80203The getgrav/grav-plugin-api plugin before 1.0.18 does not en…9.8
• CVE-2026-80204The Grav API plugin (getgrav/grav-plugin-api) before 1.0.18 …5.4
• CVE-2026-80205NLTK versions before 3.10.0 contain a regular expression den…7.5
• CVE-2026-80207APITable through 1.13.0-beta.1 annotates the create handler …5.3
• CVE-2026-80208APITable through 1.13.0-beta.1 annotates both getUserHistori…8.2
• CVE-2026-80209The updateWorkspace handler in mods/identity/src/workspaces/…4.3
• CVE-2026-8021Script injection in UI in Google Chrome prior to 148.0.7778.…4.2
• CVE-2026-80210FrontAccounting through 2.4.20 generates a CSRF token in end…6.5
• CVE-2026-80211FrontAccounting through 2.4.20 stores and verifies user pass…5.9