CVE-2026-81722

Analyzed Analyzed - Analysis Complete

Inefficient Algorithm Complexity DoS in NLTK PorterStemmer

Publication date: 2026-08-27

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-81722

EUVD

EUVD-2026-67072

Affected Vendors & Products

Vendor	Product	Version / Range
nltk	nltk	to 3.10.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in the nltk PorterStemmer library versions before 3.10.3. It occurs due to inefficient algorithmic complexity in the PorterStemmer.stem() function. The helper function _is_consonant() repeatedly scans long runs of 'y' characters, causing O(n^2) performance degradation. A malicious token with a long sequence of 'y' followed by a suffix can consume excessive CPU resources, leading to system unavailability.

Detection Guidance

This vulnerability is specific to the NLTK library's PorterStemmer component. Detection involves checking the installed version of NLTK. Run 'pip show nltk' or 'pip list' to verify if the version is below 3.10.3. If vulnerable, update immediately.

Impact Analysis

This vulnerability can cause denial of service by consuming excessive CPU resources on systems using affected nltk versions. A single crafted input token can pin a CPU core for seconds to minutes, degrading system performance or crashing applications. Systems processing untrusted text inputs are particularly vulnerable.

Compliance Impact

This vulnerability causes a denial of service by consuming excessive CPU resources, which could lead to system unavailability. For compliance standards like GDPR and HIPAA, which require data availability and security, prolonged unavailability could result in violations due to failure to maintain access to critical systems.

Mitigation Strategies

Upgrade NLTK to version 3.10.3 or later using 'pip install --upgrade nltk'. If immediate upgrade isn't possible, restrict untrusted input processing or disable PorterStemmer functionality until patched.

Hi! I’m here to help you understand CVE-2026-81722. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70