PT-2026-82617 · Pypi · Nltk Porterstemmer
CVE-2026-81722
·
Published
2026-08-27
·
Updated
2026-09-02
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
nltk PorterStemmer versions prior to 3.10.3
Description
The PorterStemmer contains an inefficient-algorithmic-complexity issue that can lead to a denial of service. The
is consonant() helper function walks backward over trailing 'y' characters on every call, and the measure() function invokes it for each stem position, resulting in O(n^2) behavior. An untrusted token of approximately 20-50 KB consisting of a long sequence of the letter 'y' followed by a matching suffix, such as 'ness', can pin a CPU core for several seconds or minutes, impacting system availability. This occurs within the stem() function.Recommendations
Update nltk PorterStemmer to version 3.10.3.
Exploit
Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nltk Porterstemmer