CVE-2026-81725 is a ReDoS vulnerability in the nltk.corpus.reader.pl196x.Pl196xCorpusReader, specifically in the TEICorpusView.read_block method. The issue is due to lazy '.*?' regexes that rescan malformed TEI blocks containing many unmatched opening tags, causing quadratic CPU time growth during parsing operations such as words() and tagged_words(). Both published version 3.9.4 and source version 3.10.0-rc2 demonstrate the issue. The vulnerability allows an attacker supplying malformed corpus files to cause heavy CPU usage and stall parser threads. A patch is not yet available, but remediation involves replacing the regex-based parser with a linear or bounded tokenizer approach.

Attackers can supply malformed TEI corpus files with many unmatched opening tags to cause the Pl196xCorpusReader to consume excessive CPU resources, leading to denial of service by stalling parser threads. This impacts applications that parse attacker-influenced corpus files using public reader APIs such as words() and tagged_words(). There is no indication of data breach or code execution, only resource exhaustion.

A patch is available but not yet released. The vendor recommends replacing the lazy regex parser with a linear parser or bounded tokenizer and adding regression tests to ensure near-linear parsing time on malformed inputs. Until a patch is released, users should avoid processing untrusted or attacker-controlled corpus files with Pl196xCorpusReader to mitigate risk.