Junglewise Threat Intelligence

CVE-2026-72818: NLTK TweetTokenizer denial of service via regex catastrophic backtracking

CVE-2026-72818 · Severity: high · CVSS 7.5 · Published 2026-08-21

Executive brief

NLTK's TweetTokenizer is a library component designed to parse social media text, including from untrusted sources. A flaw in its URL-matching regular expression causes it to consume excessive CPU when processing specially crafted input containing many alternating dots and letters (e.g., "a.a.a.a..."), resulting in service outages that require no authentication and can be triggered by a single request.

Technical details

The vulnerability is a regular expression denial of service (ReDoS) attack caused by catastrophic backtracking in the URLS pattern within nltk/tokenize/casual.py. The vulnerable regex branch for naked domains is [a-z0-9]+(?:[.\-][a-z0-9]+)*[.][a-z]{2,13}\b; the unbounded repetition [a-z0-9]+(?:[.\-][a-z0-9]+)* can partition input like "a.a.a.a..." in exponentially many ways. When the mandatory trailing top-level domain ([.][a-z]{2,13}\b) fails to match, the regex engine explores all possible partitions before failing at each offset, consuming seconds to minutes of CPU on just a few kilobytes of input. TweetTokenizer.tokenize() calls this regex via WORD_RE.findall(), and the HANG_RE pre-processing substitution does not mitigate the issue. The attack requires no authentication and exploits the tokenizer's intended use case of processing untrusted social media text. NLTK version 3.10.1 fixes this by bounding the label repetition in the regex pattern.

Affected products

  • NLTK Project NLTK < 3.10.1

Timeline

  • 2026-08-21: disclosed: Published to GitHub Advisory Database
  • 2026-08-01: patched: NLTK version 3.10.1 released with fix bounding label repetition

References

Related threats