CVE-2026-81725

3.7 Faible

Publiée le 27/08/2026 à 19:21 · Modifiée le 01/09/2026 à 22:06 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.3 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	3.7 Faible	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L`

Faiblesses (CWE)

CWE-400

Références

https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj ExploitVendor Advisory
https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusreader Third Party Advisory

CVE-2026-81725

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs