High [CVE-2026-80205] Denial of Service via unvalidated regular expressions

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout.

Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process. A flaw was found in NLTK.

These methods accept user-supplied regular expressions without validation, allowing an attacker to provide crafted patterns that cause catastrophic backtracking. The functions process unvalidated, user-supplied regular expressions without evaluation timeouts.

An unauthenticated remote attacker can exploit this by supplying a specially crafted regex pattern designed to trigger catastrophic backtracking. This causes CPU resource exhaustion within the hosting Python process context, leading to a denial-of-service condition for all dependent services running within that execution environment.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333.

Affected Red Hat products: Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.5; Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI). Red Hat lists OpenShift Lightspeed as not affected.