NLTK ReDoS in Text.findall() via unvalidated regex

Severity: high · CVSS 7.5 · Published 2026-08-26

NLTK is a widely-used Python library for natural language processing. The Text.findall() and TokenSearcher.findall() methods accept user-supplied regular expression patterns without timeout protection or complexity validation. An attacker can supply a crafted regex pattern with nested quantifiers that causes catastrophic backtracking, consuming 100% CPU indefinitely and freezing all users of the affected Python process.

Technologies: nltk (PyPI). Vendors: PyPI.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 26 August 2026.
Which products and versions are affected?
nltk (PyPI) <= 3.9.4.
Is there a fix for This vulnerability?
A patch was published on 2026-08-12: Patched in version 3.10.0 (commit d8e4753) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run nltk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a regular expression denial of service (ReDoS, CWE-1333) in the nltk.text module. The vulnerable code is in TokenSearcher.findall() (line 255) and Text.findall() (line 620), which accept user-supplied regex patterns and pass them directly to Python's re.findall() without timeout protection or backtracking complexity validation. The preprocessing applies only syntactic transformations (angle-bracket conversions) but does not inspect or reject patterns with nested quantifiers prone to catastrophic backtracking. An unauthenticated attacker can exploit this over the network if the application exposes findall() to external input. The attack causes exponential state enumeration in the regex engine, pinning the CPU at 100% indefinitely. The vulnerability was patched in version 3.10.0 (commit d8e4753), which replaces the stdlib re module with the regex library that supports timeout parameters and raises TimeoutError instead of hanging.

Affected products

  • NLTK Project NLTK <= 3.9.4

Timeline

  • 2026-08-26: disclosed
  • 2026-08-12: patched: Patched in version 3.10.0 (commit d8e4753)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.