CVE-2026-81722: nltk PorterStemmer before 3.10.3 Quadratic-time DoS
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The isconsonant() helper walks backward over the entire run of trailing 'y' characters on every call, and measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nltk PorterStemmerto a version that resolves this vulnerability.Fixed in 3.10.3 - Compensating control
Mitigate availability impact by restricting or throttling requests that supply untrusted tokens with long runs of 'y' (e.g., deny/limit inputs matching a long 'y' run followed by suffix patterns like 'ness') before calling PorterStemmer.stem().
Event History
Frequently Asked Questions
Who is realistically exposed to this denial of service?
Applications using nltk PorterStemmer on attacker-controlled or otherwise untrusted tokens are exposed. A single crafted token can consume a CPU core for seconds to minutes.
What input is needed to trigger the issue?
An attacker needs to submit a roughly 20–50 KB token containing a long run of the letter "y" followed by a matching suffix, such as "ness". No authentication or user interaction is required according to the supplied vector.
Are affected versions fixed, and what should be upgraded?
The issue affects nltk PorterStemmer versions 3.10.2 and earlier and is fixed in version 3.10.3. Upgrade to 3.10.3 to remove the inefficient quadratic-time behavior.
What can be done if upgrading is not immediately possible?
Limit the maximum length of untrusted tokens before passing them to PorterStemmer, particularly tokens with long repeated-character runs. This reduces the ability to submit the 20–50 KB crafted inputs described for exploitation.