The TweetTokenizer regular expression, compiled into WORD_RE, includes an unbounded naked‑domain branch that can be partitioned in exponentially many ways when presented with input that alternates label separators but lacks a top‑level domain. Because the engine enumerates all these partitions before failing, a few kilobytes of such crafted text can cause the tokenizer to consume seconds to minutes of CPU time. Since the tokenizer is intended for processing untrusted social‑media text, any service that uses TweetTokenizer.tokenize or casual_tokenize on user‑supplied content will become stalled per request without authentication. The vulnerability is a classic example of the Defect 1333: Improper Regular Expression Validation, leading to a denial‑of‑service.

NLTK versions 3.6.5 through 3.9.2, including the beta 3.9‑beta1 release, are affected. The issue is present in the function casual_tokenize in nltk.tokenize.casual.py and is observed whenever the default TweetTokenizer is used. Version 3.10.1 of NLTK corrects the regular expression by bounding the domain‑label repetition, preventing the catastrophic backtracking scenario.

The CVSS score of 8.7 indicates high severity. EPSS is not available, but lack of an EPSS score does not diminish the risk; the vulnerability was identified publicly in August 2026 and is not listed in CISA’s KEV catalog, implying no known large‑scale exploits yet. Based on the description, the likely attack vector is sending specially crafted input that imitates domain patterns but without a top‑level domain to any service that processes user text with TweetTokenizer or casual_tokenize. No authentication is required, making the attack trivial to trigger from outside. Because the effect is a complete stall of the tokenization routine, the vulnerable system may experience service interruption for each request, leading to denial of service.