PatchTheCVECVE-2026-81725: NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that al
CVE-2026-81725 is a low-severity flaw (CVSS 3.7) affecting nltk. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the read_block method through public APIs like words() and tagged_words() to force repeated rescans and achieve near-quadratic runtime growth.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.7 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 69%) |
| CISA exploited list | No |
| Weakness | CWE-400 |
| Published | 2026-08-27 |
| Last modified | 2026-09-01 |
Last updated 2026-09-01 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-81725?
nltk: upgrade to 3.10.3. Exact commands for each OS are on this page.
Is CVE-2026-81725 being exploited?
CVE-2026-81725 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-81725 affect?
CVE-2026-81725 affects nltk. Severity is low (CVSS 3.7). NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers ca
How urgent is CVE-2026-81725?
Priority 31/100. Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-12252 HIGH 7.8 UPGRADE In nltk/nltk versions 3.9.3 and earlier, five Stanford interface classes (StanfordPOSTagger, StanfordNERTagger
- CVE-2026-12259 MEDIUM 6.5 DOWNGRADE In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package
- CVE-2026-12261 MEDIUM 6.5 UPGRADE A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and mode
- CVE-2026-12372 LOW 3.7 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop
- CVE-2026-71513 HIGH 8.8 UPGRADE NLTK before 3.10.3 contains a remote code execution vulnerability in AllowlistUnpickler that validates only th