Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-26T10:28:14 nltk: NLTK: Denial of Service via unvalidated regular expressions 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-1333

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

A flaw was found in NLTK. A remote attacker can exploit a regular expression denial of service (ReDoS) vulnerability in the `Text.findall()` and `TokenSearcher.findall()` methods. These methods accept user-supplied regular expressions without validation, allowing an attacker to provide crafted patterns that cause catastrophic backtracking. This can lead to indefinite CPU saturation, resulting in a denial of service to all users of the Python process.

A Regular Expression Denial of Service (ReDoS) vulnerability was identified in NLTK's `Text.findall()` and `TokenSearcher.findall()` methods. The functions process unvalidated, user-supplied regular expressions without evaluation timeouts. An unauthenticated remote attacker can exploit this by supplying a specially crafted regex pattern designed to trigger catastrophic backtracking. This causes CPU resource exhaustion within the hosting Python process context, leading to a denial-of-service condition for all dependent services running within that execution environment. Sanitize all untrusted input passed to `Text.findall()` or `TokenSearcher.findall()` to prevent execution of arbitrary or unvalidated regular expressions, or enforce execution timeouts via worker process isolation to bound CPU consumption. Red Hat OpenShift AI 3.5 2026-09-21T00:00:00Z RHSA-2026:69539 rhoai/odh-ta-lmes-job-rhel9:1788935863 Exploit Intelligence Will not fix exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Lightspeed Core Affected lightspeed-core/lightspeed-stack-rhel9 Lightspeed Core Affected lightspeed-core/rag-tool-cpu-rhel9 Lightspeed Core Affected lightspeed-core/rag-tool-cuda-12.9-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-service-api-rhel9 OpenShift Lightspeed Not affected openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-ogx-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-80205 https://nvd.nist.gov/vuln/detail/CVE-2026-80205 https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55 https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-unvalidated-regex