PYSEC-2026-3750

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking,...

CVE-2026-80206

NLTK (a Python natural language processing library) versions before 3.10.3 contain a ReDoS vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels witho...

CVE-2026-80206 NLTK 3.10.2 Regular Expression Denial of Service via tgrep

NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or...

CVE-2026-80206 NLTK 3.10.2 Regular Expression Denial of Service via tgrep

NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or...

CVE-2026-80206 NLTK 3.10.2 Regular Expression Denial of Service via tgrep

NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or...

CVE-2026-80205 NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking,...

CVE-2026-80205

NLTK versions before 3.10.0 are vulnerable to a ReDoS (Regular Expression Denial of Service) in the Text.findall() and TokenSearcher.findall() methods. These methods accept user-supplied regular expressions without validation or a timeout mechanism, allowing an attacker to supply crafted patterns...

CVE-2026-80205 NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking,...

CVE-2026-80205 NLTK before 3.10.0 ReDoS via Text.findall() unvalidated regex

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking,...

CVE-2026-80206: Inefficient Regular Expression Complexity

NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The tgrepnodeaction function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or...

Linux Distros Unpatched Vulnerability : CVE-2026-80205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept...

CVE-2026-62326: Uncontrolled Resource Consumption

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

CVE-2026-80205: Inefficient Regular Expression Complexity

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall and TokenSearcher.findall methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking,...

Linux Distros Unpatched Vulnerability : CVE-2026-79770

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifi...

PT-2026-88957

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.60 Description A regular expression denial of service exists in the Actor.name email regex function that processes commit author and committer fields. An attacker can craft a commit object with a malformed autho...

PT-2026-82301

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall...

PT-2026-82080

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description The tgrep module contains a regular expression denial of service ReDoS issue. The tgrep node action function compiles user-supplied regular expressions within /regex/ pattern nodes and executes them...

PT-2026-82079

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0 Description An issue exists where the findall functions within the Text and TokenSearcher classes accept user-supplied regular expressions without validation or timeout. This can lead to catastrophic backtracking—...

GHSA-5JHF-FPP7-V2PV Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c4rq-3m3g-8wgx. This link is maintained to preserve external references. Original Description Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector...

Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c4rq-3m3g-8wgx. This link is maintained to preserve external references. Original Description Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector...