PyPI: nltk
CVE-2026-81725
Safety vulnerability ID: SFTY-20260908-61270
Affected versions of the NLTK package are vulnerable to Regular Expression Denial of Service (ReDoS) due to unbounded regular expression complexity in parsing TEI blocks. The `nltk.corpus.reader.pl196x.TEICorpusView.read_block` method and public methods of `Pl196xCorpusReader` use lazy regexes to parse entire `<text>` blocks, which rescan from each opening tag position when unmatched tags are present. An attacker can exploit this by supplying malformed corpus files containing numerous unmatched opening tags, causing quadratic CPU growth and potentially causing denial of service through excessive resource consumption.
Overview
NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks
Advisory
nltk – Denial of Service (DoS)
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20260908-61270/CVE-2026-81725
- https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj
- https://nvd.nist.gov/vuln/detail/CVE-2026-81725
- https://github.com/nltk/nltk/commit/7808692d451b962711005d954859bb83aabcf8fa
- https://github.com/nltk/nltk/releases/tag/v3.10.3
- https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3752.yaml
- https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusreader
- https://github.com/advisories/GHSA-8mpw-7fpc-4gqj
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more