SEPTEMBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-80206

MEDIUM · CVSS 5.9 EPSS 0.26% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-26 · Last synced 2026-09-14

CyberRota Analysis

AI-Generated

The tgrep module in NLTK versions prior to 3.10.3 is vulnerable to a regular expression denial of service (ReDoS) attack due to improper handling of user-supplied regex patterns, which can lead to excessive CPU consumption and process blocking. This vulnerability poses a risk to any application utilizing NLTK for text processing, particularly those that expose tgrep functions to external input. Organizations using affected versions should prioritize updating to mitigate potential service disruptions.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-80206
Severity
MEDIUM
CVSS
5.9
EPSS
0.26%

Original NVD Description

NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process.

Related CVEs

Other vulnerabilities affecting the same vendor(s)