CVE-2026-80205 nltk CVE debrief

Who should care

Users of NLTK versions before 3.10.0, especially those using the Text.findall() and TokenSearcher.findall() methods, should be aware of the potential denial of service vulnerability and take defensive actions. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess and mitigate the risk associated with this vulnerability.

Technical summary

The CVE-2026-80205 vulnerability affects NLTK versions before 3.10.0, specifically the Text.findall() and TokenSearcher.findall() methods. These methods accept user-supplied regular expressions without validation or timeout, allowing attackers to supply crafted regex patterns that cause catastrophic backtracking. This results in indefinite CPU saturation and denial of service to all users of the Python process. The vulnerability has a HIGH CVSS score of 8.7, indicating a high severity. The NVD entry is currently Modified.

Defensive priority

High-priority defensive actions are required due to the HIGH CVSS score of 8.7 and the potential for denial of service attacks.

Recommended defensive actions

• Inventory and assess NLTK usage in Python processes
• Upgrade NLTK to version 3.10.0 or later
• Implement compensating controls to monitor and limit resource usage
• Review and restrict user-supplied regular expressions
• Monitor for suspicious activity and exception tracking
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-80205 record indicates a regular expression denial of service vulnerability in NLTK versions before 3.10.0. The vulnerability affects the Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Limited information is available on the scope of affected users and potential attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.