Denial of Service in nltk PorterStemmer Affects Python Natural Language Toolkit

CVE-2026-81722

What is CVE-2026-81722?

The nltk PorterStemmer, in versions prior to 3.10.3, is susceptible to a denial of service vulnerability due to inefficient algorithmic complexity in its stem() function. The _is_consonant() helper function traverses a sequence of 'y' characters each time it's called, while the _measure() function invokes it for each stem position, leading to O(n^2) behavior. An attacker can exploit this vulnerability by providing a crafted input, consisting of a lengthy string of 'y' characters followed by a matching suffix (e.g., 'ness'), which can significantly burden a CPU core, causing long delays and potential service unavailability.

References