Gptline: NLTK TweetTokenizer vulnerable to denial of service through catastrophic regex backtracking (CVE-2026-72818)

The vulnerability (CVE-2026-72818) resides in the URLS regular expression within nltk/tokenize/casual.py, compiled into TweetTokenizer.WORD_RE and used by TweetTokenizer.tokenize. The regex contains an unbounded naked-domain branch with a domain-label prefix pattern that can be partitioned in exponentially many ways when given input with many alternating label separators. Because the regex requires a trailing top-level domain that crafted input lacks, the regex engine explores all partitions before failing, causing severe CPU consumption and denial of service. The HANG_RE substitution does not mitigate this. This affects services applying TweetTokenizer or casual_tokenize to untrusted text. Version 3.10.1 introduced bounding of label repetition to fix the issue.

An attacker can cause denial of service by submitting crafted text that triggers catastrophic backtracking in the TweetTokenizer regex, resulting in high CPU usage and service stalls. There is no impact on confidentiality or integrity. The vulnerability requires no authentication and can be triggered remotely by submitting malicious input to affected services.

A patch is available that bounds the label repetition in the vulnerable regex, introduced in version 3.10.1. Users should upgrade to version 3.10.1 or later to remediate this vulnerability. Until patched, avoid applying TweetTokenizer or casual_tokenize to untrusted input or implement input validation to limit input complexity.