THREAT OPS › Threat News › [GHSA] GHSA-rrv8-h7p8-rx55 (high) — NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
[GHSA] GHSA-rrv8-h7p8-rx55 (high) — NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
GHSA-rrv8-h7p8-rx55 Severity: high CVE: CVE-2026-80205
NLTK: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
### Summary NLTK's `Text.findall()` and `TokenSearcher.findall()` methods accept user-supplied regular expressions and pass them to the Python `re` engine without timeout or validation, enabling catastrophic backtracking (ReDoS). This issue is isolated
Indicators of compromise
- CVE-2026-80205cve
- https://www.offgridsec.comurl
Original source: https://github.com/advisories/GHSA-rrv8-h7p8-rx55