VulnerabilityModified

CVE-2026-80205

HIGH 8.7EPSS 0.49%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.49% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-1333
Affected: nltk/nltk
Source: disclosure@vulncheck.com

References

https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55Exploit, Vendor Advisory
https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-unvalidated-regexThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/09/01/3

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.