Vulnerability · Published Aug 20, 2026 · Assigned by VulnCheck
CVE-2026-72818NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input
High 7.5
In plain English
A high-severity regular-expression denial of service in nltk from nltk. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nltk | no fix listed | DEBIAN-CVE-2026-72818 |
| Debian:13 | nltk | no fix listed | DEBIAN-CVE-2026-72818 |
| Debian:14 | nltk | 3.10.3-1 | DEBIAN-CVE-2026-72818 |
| PyPI | nltk | 3.10.1 | GHSA-qx2g-xrx7-vfh8 |
| PyPI | nltk | 3.10.1 | PYSEC-2026-3870 |
| Ubuntu:26.10 | nltk | no fix listed | UBUNTU-CVE-2026-72818 |
Affected products (as reported)
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Issue #3704 issue-tracking
- Unbounded naked-domain branch in the URLS pattern at 3.9.4 technical-description
- NLTK v3.10.1 Release Notes release-notes
- https://github.com/nltk/nltk product
- VulnCheck Advisory: NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input third-party-advisory