Junglewise Threat Intelligence

CVE-2026-81722: NLTK PorterStemmer quadratic-time DoS via long runs of 'y'

CVE-2026-81722 · Severity: medium · CVSS 6.9 · Published 2026-09-02

Executive brief

NLTK's PorterStemmer is a widely used text processing tool applied to search queries, document indexing, and natural language pipelines. An attacker can craft a single token containing tens of thousands of consecutive 'y' characters (e.g., 20 KB), which causes the stemmer to consume multiple seconds of CPU time per request due to an inefficient algorithm, potentially exhausting server resources and degrading service availability. There is no impact to data confidentiality or integrity.

Technical details

The `_is_consonant()` function in PorterStemmer uses an iterative backward walk to classify the letter 'y', intended to fix an earlier stack overflow issue. However, this function is called once for every character position in the stem by `_measure()`. For a token with n consecutive 'y' characters, this results in O(n²) total operations (sum of 1+2+...+n). A crafted token like 'y'*20000 + 'ness' requires >20 seconds to process. The vulnerability is reachable via untrusted input in search, indexing, and NLP systems. No authentication is required; the attack is network-accessible. The fix (version 3.10.3 and later) pre-computes consonant/vowel classification in a single O(n) pass.

Affected products

  • NLTK Project NLTK <= 3.10.2

Timeline

  • 2026-08-12: disclosed
  • 2026-08-12: patched: Version 3.10.3 released
  • 2026-09-02: advisory: GitHub Advisory published

References

Related threats