Advisory details:
github_osv / GHSA-8mpw-7fpc-4gqj
| Advisory ID | github_osv/GHSA-8mpw-7fpc-4gqj |
| Aliases |
CVE-2026-81725
|
| Summary | NLTK: Pl196xCorpusReader has quadratic ReDoS on malformed TEI blocks ### Summary `Pl196xCorpusReader` still parses whole TEI blocks with multiple lazy regexes over attacker-controlled text. A malformed file with many opening tags and no matching closing tags forces repeated rescans and produces quadratic CPU growth in public reader APIs. ### Details - **Vulnerability type:** Regular-expression denial of service - **Affected component:** `nltk.corpus.reader.pl196x.TEICorpusView.read_block` and `Pl196xCorpusReader` public methods - **Affected versions:** Published `3.9.4` and current source `v3.10.0-rc2` both reproduced. - **Patched versions:** Not yet patched - **Root cause:** Lazy `.*?` whole-block regexes rescan untrusted XML-like blocks from each opening-tag position. The parser uses regexes for paragraphs, sentences, and word tags across the whole `<text>` block. When the attacker supplies many unmatched opening tags, each attempt scans toward the end of the block and fails, then restarts from the next opening tag. There is near four-times runtime growth each time the number of malformed `<p>` tags doubled, through normal public calls such as `words()` and `tagged_words()`. ### PoC **Preconditions** - The application parses attacker-influenced PL196X or TEI-like corpus files through public reader APIs. **Steps** 1. Create a corpus file with a valid header followed by a `<text>` block that contains many opening tags and no matching closing tags. 2. Instantiate `Pl196xCorpusReader` on that corpus. 3. Call `words()` or `tagged_words()` and measure elapsed time as the malformed tag count doubles. 4. Observe near quadratic growth instead of near-linear behavior. **Minimal reproducible excerpt** ```text size=1000 0.014s size=2000 0.057s size=4000 0.231s size=8000 0.927s ``` ### Impact A consumer that accepts attacker-influenced corpus files can be forced into heavy CPU use and parser-thread stalling before the application concludes the input contains no valid content. ### Remediation Replace the whole-block lazy-regex parser with a linear parser or bounded tokenizer, and add regression tests that assert near-linear behavior on malformed inputs with many unmatched tags. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.7 |
| Risk | 2.9 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv4 | 6.3 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-8mpw-7fpc-4gqj/GHSA-8mpw-7fpc-4gqj.json |
| generic_textual | MODERATE |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Attack Requirements (AT) | Privileges Required (PR) | User Interaction (UI) | Vulnerable System Impact Confidentiality (VC) | Vulnerable System Impact Integrity (VI) | Vulnerable System Impact Availability (VA) | Subsequent System Impact Confidentiality (SC) | Subsequent System Impact Integrity (SI) | Subsequent System Impact Availability (SA) |
|---|---|---|---|---|---|---|---|---|---|---|
network adjacent local physical |
low high |
none present |
none low high |
none passive active |
high low none |
high low none |
high low none |
high low none |
high low none |
high low none |
There are no SSVC decisions available.