CVE-2026-81725
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.
- Affected products
- Nltk
- CVSS 4.0
- 6.3 MEDIUM
- CVSS 3.1
- 3.7 LOW
- Weakness
- CWE-400
- NVD status
- Received
- Published
- 2026-08-27
CVE-2026-81725 at NVD
No indexed exploits for CVE-2026-81725 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-81725 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.