CVE-2026-80205

Affected versions of the NLTK package are vulnerable to Regular Expression Denial of Service (ReDoS) due to unvalidated user-supplied regular expressions. The `nltk.text.Text.findall()` and `nltk.text.TokenSearcher.findall()` methods pass user-controlled regular expressions directly to the Python `re` engine without implementing a timeout or validation mechanism, leading to potential catastrophic backtracking. An attacker can exploit this vulnerability by providing a specially crafted regular expression that triggers excessive backtracking, resulting in indefinite CPU saturation and denial-of-service for applications that expose these methods to external input.