THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-8mpw-7fpc-4gqj (medium) — NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

[GHSA] GHSA-8mpw-7fpc-4gqj (medium) — NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

medgithub_advisoriesPublished 2026-09-08

GHSA-8mpw-7fpc-4gqj Severity: medium CVE: CVE-2026-81725

NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks

### Summary

`Pl196xCorpusReader` still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs.

Indicators of compromise

CVE-2026-81725cve

Original source: https://github.com/advisories/GHSA-8mpw-7fpc-4gqj