{"apiVersion":"1.0","identifier":"CVE-2026-72818","description":"The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.","publishedAt":"2026-08-20T22:18:05","lastModifiedAt":"2026-08-21T11:17:05","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72818","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","epssProbability":0.00505,"riskScore":0.78,"affectedProduct":"nltk","affectedVersions":"<3.10.1","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72818","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72818","en":"https://www.redsauce.net/en/cves/CVE-2026-72818","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72818","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72818","de":"https://www.redsauce.net/de/cves/CVE-2026-72818","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72818","el":"https://www.redsauce.net/el/cves/CVE-2026-72818"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72818"}}