---
id: CVE-2026-72818
title: >-
  The URLS regular expression in nltk/tokenize/casual.py, compiled into
  TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a
  naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is
  unbounded
summary: >-
  The URLS regular expression in nltk/tokenize/casual.py, compiled into
  TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a
  naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is
  unbounded. Inpu…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-1333
vendor: nltk
product: nltk
affected:
  - nltk < 3.10.1
patched:
  - nltk 3.10.1
published: '2026-08-20'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:02:50.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72818'
references:
  - url: 'https://github.com/nltk/nltk'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nltk/nltk/blob/3.9.4/nltk/tokenize/casual.py'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nltk/nltk/issues/3704'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nltk/nltk/releases/tag/v3.10.1'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nltk-tweettokenizer-url-pattern-backtracks-catastrophically-on-naked-domain-like-input
    label: disclosure@vulncheck.com
  - url: 'https://github.com/nltk/nltk/issues/3704'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72818'
  - url: 'https://github.com/nltk/nltk/pull/3701'
  - url: >-
      https://github.com/nltk/nltk/commit/e092ed52eccae642304448bffc8d23cb301f85c1
  - url: 'https://pypi.org/project/nltk'
  - url: 'https://github.com/advisories/GHSA-qx2g-xrx7-vfh8'
tags:
  - nvd
  - cve.org
  - exploit-available
  - osv
  - pip
epss: 0.00742
epssPercentile: 0.52728
aliases:
  - GHSA-qx2g-xrx7-vfh8
  - PYSEC-2026-3870
ecosystem: pip
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-21T11:05:49.886911Z'
ingestedAt: '2026-09-02T19:31:23.652Z'
---

## Overview

The URLS regular expression in nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and applied by TweetTokenizer.tokenize, contains a naked-domain branch whose domain-label prefix [a-z0-9]+(?:[.\-][a-z0-9]+)* is unbounded. Input consisting of many alternating label separators can be partitioned in exponentially many ways, and because the branch also requires a trailing top-level domain that such input never supplies, the engine explores those partitions before failing at each offset. A few kilobytes of input therefore consumes seconds to minutes of single-threaded CPU, and the HANG_RE substitution performed before matching does not collapse the pattern. TweetTokenizer is intended for tokenizing untrusted social-media text, so any service that applies it, or the module-level casual_tokenize, to submitted text can be stalled per request without authentication. Version 3.10.1 bounds the label repetition.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-72818)

Affected packages:

- `nltk < 3.10.1`

Patched in:

- `nltk 3.10.1`

Source: https://osv.dev/vulnerability/GHSA-qx2g-xrx7-vfh8