CVE-2026-72818
2 advisories.
PyPI/nltk CVE-2026-72818: high 7.5, EPSS 0.74%
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
Action: Upgrade nltk to 3.10.1 or later.
pip install nltk==3.10.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.10.1 | - |
Fixed versions
| 3.10.1 |
Sources
- osv: GHSA-qx2g-xrx7-vfh8
- https://nvd.nist.gov/vuln/detail/CVE-2026-72818
- https://github.com/nltk/nltk/issues/3704
- https://github.com/nltk/nltk/pull/3701
- https://github.com/nltk/nltk/commit/e092ed52eccae642304448bffc8d23cb301f85c1
- https://github.com/nltk/nltk
- https://github.com/nltk/nltk/blob/3.9.4/nltk/tokenize/casual.py
- https://github.com/nltk/nltk/releases/tag/v3.10.1
- https://www.vulncheck.com/advisories/nltk-tweettokenizer-url-pattern-backtracks-catastrophically-on-naked-domain-like-input
CVE-2026-72818 · published · modified · JSON
PyPI/nltk CVE-2026-72818: high 7.5, EPSS 0.74%
NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking
Action: Upgrade nltk to 3.10.1 or later.
pip install nltk==3.10.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.10.1 | - |
Fixed versions
| 3.10.1 |
Sources
- osv: PYSEC-2026-3870
- https://nvd.nist.gov/vuln/detail/CVE-2026-72818
- https://github.com/nltk/nltk/issues/3704
- https://github.com/nltk/nltk/pull/3701
- https://github.com/nltk/nltk/commit/e092ed52eccae642304448bffc8d23cb301f85c1
- https://github.com/nltk/nltk
- https://github.com/nltk/nltk/blob/3.9.4/nltk/tokenize/casual.py
- https://github.com/nltk/nltk/releases/tag/v3.10.1
- https://www.vulncheck.com/advisories/nltk-tweettokenizer-url-pattern-backtracks-catastrophically-on-naked-domain-like-input
- https://pypi.org/project/nltk
- https://github.com/advisories/GHSA-qx2g-xrx7-vfh8
CVE-2026-72818 · published · modified · JSON