The NLTK tgrep module is vulnerable to a Regular Expression Denial of Service (ReDoS) due to unvalidated user-supplied regular expressions being compiled and executed without timeout. This allows an attacker to craft regex patterns that cause catastrophic backtracking, leading to indefinite CPU consumption and denial of service. The vulnerability affects versions up to 2.0.0_5 and is confirmed with exponential runtime growth in regex evaluation. A patch is available in version 2.0.0_5.