The NLTK tgrep module suffers from a Regular Expression Denial of Service (ReDoS) vulnerability due to unvalidated user-supplied regex patterns compiled without timeout. This allows an attacker to cause catastrophic backtracking, leading to indefinite CPU consumption and denial of service in applications exposing the tgrep API to external input. The vulnerability affects NLTK versions up to 3.10.2 and has been confirmed with proof-of-concept code demonstrating exponential runtime growth. A patch is available to mitigate this issue.