NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.\-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned i...

PYSEC-2026-3870 NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818

A flaw was found in NLTK. The TweetTokenizer component, used for processing social media text, contains a regular expression vulnerability. A remote unauthenticated attacker can provide specially crafted input containing many alternating label separators, causing the regular expression to backtra...

GHSA-QX2G-XRX7-VFH8 NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...