EUVD-2026-63729

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

DEBIAN-CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

CVE-2026-72818

NLTK (Python NLP library) is vulnerable to catastrophic regex backtracking in nltk/tokenize/casual.py. The TweetTokenizer.WORD_RE pattern contains an unbounded naked-domain label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)*. Crafted input with many alternating label separators causes the regex engine to e...

CVE-2026-72818 NLTK TweetTokenizer URL Pattern Backtracks Catastrophically on Naked-Domain-Like Input

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORDRE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix a-z0-9+?:.-a-z0-9+ is unbounded. Input consisting of many alternating label separators can be partitioned in...

PT-2026-79260

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.1 Description The URLS regular expression in nltk/tokenize/casual.py, which is compiled into TweetTokenizer.WORD RE and used by TweetTokenizer.tokenize, contains an unbounded domain-label prefix. When processing inp...

Linux Distros Unpatched Vulnerability : CVE-2026-12841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - nltk - None Ubuntu Linux - Unknown description CVE-2026-12841 Note that Nessus relies on the presence of the package as reported by the vendor...

python313-nltk-3.10.2-1.1 on GA media (moderate)

python313-nltk-3.10.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11510-1 Rating: moderate Cross-References: CVE-2026-12372 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

EUVD-2026-40240

nltk: Arbitrary File Read via Path Traversal in nltk.data.load through Percent-Encoded Sequences...

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

Summary nltk.data.load and nltk.data.find resolve user-supplied resource names to filesystem paths using url2pathname, which decodes percent-encoded sequences e.g. %2e%2e to ... Path safety checks are performed on the raw, still-encoded string before decoding occurs. An attacker supplying %2e%2e...

Linux Distros Unpatched Vulnerability : CVE-2026-12072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - nltk - None Ubuntu Linux - Unknown description CVE-2026-12072 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-12074

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - nltk - None Ubuntu Linux - Unknown description CVE-2026-12074 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-12061

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - nltk - None Ubuntu Linux - Unknown description CVE-2026-12061 Note that Nessus relies on the presence of the package as reported by the vendor...

PT-2026-81276

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description Allowlisted pickle loaders trust entire module namespaces instead of specific safe callables. This allows attackers to craft malicious pickle payloads that use the pickle REDUCE mechanism to invoke...

EUVD-2026-54961

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

Linux Distros Unpatched Vulnerability : CVE-2026-12372

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function...

CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

DEBIAN-CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...