CVE-2026-81725

Katalog CVE

CVSS 3.7 · Low EPSS 0,37%

Kerentanan Uncontrolled Resource Consumption pada nltk. Skor CVSS 3.1 3.7 (Low) menurut vulncheck.com.

Deskripsi (NVD)

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.

Rincian

Terbit di NVD

27 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/nltk/nltk/security/advisories/GHSA-8mpw-7fpc-4gqj exploit · advisory vendor
• https://www.vulncheck.com/advisories/nltk-before-3.10.3-regular-expression-denial-of-service-via-pl196xcorpusr... advisory pihak ketiga