Description
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.
Published: 2026-08-27
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

NLTK PorterStemmer contains an algorithmic‑complexity flaw that makes its stem() routine run in O(n^2) time for certain inputs. A token composed of a long run of the letter 'y' followed by a matching suffix forces the _is_consonant() helper to scan backward repeatedly, causing the stemmer to consume a CPU core for seconds to minutes. The resulting local or remote denial of service violates system availability and is identified by CWE-407 and CWE-606.

Affected Systems

Python NLTK library, specifically the PorterStemmer component in versions 3.10.2 and earlier. Any application that performs stemming on untrusted text using NLTK, such as web services or data pipelines, is affected. The issue is fixed in NLTK 3.10.3.

Risk and Exploitability

The CVSS score of 8.7 marks this as a high‑severity flaw. While no exploit code is required beyond supplying a crafted word, the vulnerability can be triggered by any untrusted user input that feeds into the stemmer. Identified by CWE-407 and CWE-606, it can be exploited by crafting a long run of the letter 'y' followed by a matching suffix, causing a CPU core to be pinned for seconds to minutes. EPSS is less than 1%, indicating a low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, so no known widespread exploitation reports exist yet, but the high impact warrants prompt attention.

Generated by OpenCVE AI on September 1, 2026 at 18:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the NLTK package to 3.10.3 or later.
  • Sanitize or limit the length of input tokens and reject those containing excessively long runs of the letter 'y'.
  • Implement CPU or execution time limits for any process that performs stemming to contain resource usage.

Generated by OpenCVE AI on September 1, 2026 at 18:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-ww6m-cw3f-q94g NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
History

Tue, 01 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-606
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 27 Aug 2026 16:45:00 +0000

Type Values Removed Values Added
Description nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.
Title nltk PorterStemmer before 3.10.3 Quadratic-time DoS
First Time appeared Nltk
Nltk nltk
Weaknesses CWE-407
CPEs cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*
Vendors & Products Nltk
Nltk nltk
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Nltk Nltk
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-27T17:49:54.623Z

Reserved: 2026-08-27T11:13:14.064Z

Link: CVE-2026-81722

cve-icon Vulnrichment

Updated: 2026-08-27T17:49:23.759Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-27T17:21:02.800

Modified: 2026-08-31T15:44:19.437

Link: CVE-2026-81722

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-27T14:51:15Z

Links: CVE-2026-81722 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T18:15:04Z

Weaknesses
  • CWE-407

    Inefficient Algorithmic Complexity

  • CWE-606

    Unchecked Input for Loop Condition