CVE-2026-80206

CVE-2026-80206 is a regular expression denial-of-service flaw (CWE-1333) in the tgrep module of NLTK, the widely used Python natural language processing toolkit distributed via PyPI/pip. When a tgrep query contains a '/regex/' node literal, _tgrep_node_action() in nltk/tgrep.py compiles the caller-controlled pattern with re.compile() without any validation or timeout and applies it against every matching tree node label, so a pathological pattern (e.g. a nested quantifier matched against a label lacking the expected character) triggers catastrophic backtracking. An attacker who can supply a tgrep pattern to tgrep_positions() or tgrep_compile() can hang the Python process indefinitely with a single request, achieving full denial of service; the CVSS 4.0 score of 8.2 reflects availability-only impact with no confidentiality or integrity effect. Only applications that pass untrusted input into the tgrep API are affected (most NLTK users never invoke tgrep), and the advisory data confirms NLTK 3.10.2 exhibits the flaw without stating a broader affected range or a fixed version. Exploitation is not currently observed: EPSS assigns a 0.3% 30-day exploitation probability (18th percentile), the flaw is not in CISA KEV, and no public exploit is known beyond the PoC included in the advisory.

What to do: No patched release is named in the available data, so monitor the NLTK project (PyPI/GitHub) for an updated version fixing CVE-2026-80206 and upgrade when it is published. In the meantime, treat '/.../' node literals in tgrep patterns as untrusted input: validate or restrict embedded regular expressions (especially nested quantifiers), avoid passing user-supplied strings directly to tgrep_positions() or tgrep_compile(), and execute tgrep queries in a subprocess or worker with a timeout so a catastrophic-backtracking pattern cannot hang the application.