CVE-2026-80205

Katalog CVE

CVSS 7.5 · High EPSS 0,65%

Kerentanan Inefficient Regular Expression Complexity pada nltk. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

Rincian

Terbit di NVD

26 Agustus 2026

Terakhir diubah

3 September 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55 exploit · advisory vendor
• https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-unvalidated-regex advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/09/01/3