Description
The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.
Published: 2026-08-20
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.
Title NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input
First Time appeared Nltk
Nltk nltk
Weaknesses CWE-1333
CPEs cpe:2.3:a:nltk:nltk:3.6.5:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.6.6:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.6.7:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.7:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.8.1:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.8:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.9.1:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.9.2:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.9.3:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.9:*:*:*:*:*:*:*
cpe:2.3:a:nltk:nltk:3.9:beta1:*:*:*:*:*:*
Vendors & Products Nltk
Nltk nltk
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Nltk Nltk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-20T23:28:26.593Z

Reserved: 2026-08-10T15:12:16.754Z

Link: CVE-2026-72818

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-20T22:18:05.087

Modified: 2026-08-20T22:18:05.087

Link: CVE-2026-72818

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity