PyPI/nltk CVE-2026-80205: high 7.5, EPSS 0.65%

NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

Action: Upgrade nltk to 3.10.0 or later.

pip install nltk==3.10.0

Affected

Fixed versions

Sources

• osv: GHSA-rrv8-h7p8-rx55
• https://github.com/nltk/nltk/security/advisories/GHSA-rrv8-h7p8-rx55
• https://nvd.nist.gov/vuln/detail/CVE-2026-80205
• https://github.com/nltk/nltk/pull/3674
• https://github.com/nltk/nltk/commit/d8e47539317b571ab1422981f5b9653d5eae1249
• https://github.com/nltk/nltk
• https://github.com/nltk/nltk/releases/tag/v3.10.0
• https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3750.yaml
• https://www.vulncheck.com/advisories/nltk-before-3.10.0-redos-via-text-findall-unvalidated-regex
• http://www.openwall.com/lists/oss-security/2026/09/01/3

CVE-2026-80205 · published 2026-09-08T20:28:13Z · modified 2026-09-08T20:45:04.338061792Z · JSON