Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-81722— nltk PorterStemmer before 3.10.3 Quadratic-time DoS

Quick assessment

Affected
nltk nltk
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

nltk 库中版本 ≤ 3.10.2（已在 3.10.3 中修复）的 PorterStemmer 组件在 方法中存在因算法复杂度低效导致的拒绝服务（DoS）漏洞。 具体而言，辅助函数 在每次调用时都会向后退溯遍历字符串末尾所有连续的 'y' 字符；而 函数会在词的每个位置调用该辅助函数，从而导致整体时间复杂度达到 O(n²) 的平方级开销。 攻击者只需提供一个约 20-50 KB、由大量连续 'y' 后接匹配后缀（如 'ness'）的不可信输入，即可使单个 CPU 核心被占用数秒至数分钟，从而造成系统可用性问题。

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1499.001 · OS Exhaustion Flood

Affected Version Matrix 2

VendorProduct Version RangeStatus
nltk nltk < 3.10.3 affected
3.10.3 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-81722

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nltk PorterStemmer before 3.10.3 Quadratic-time DoS
Source: CVE Program / CVE List V5
Vulnerability Description
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nltk nltk 0 ~ 3.10.3 -

II. Public POCs for CVE-2026-81722

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-81722

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-81722 (2)

Same Patch Batch · nltk · 2026-08-27 · 6 CVEs total

CVE-2026-81727 7.1 HIGH NLTK before 3.10.3 Hardlink File Overwrite via downloader
CVE-2026-81726 7.0 HIGH NLTK through 3.10.3 Path Traversal via Model-Artifact APIs
CVE-2026-81724 5.3 MEDIUM NLTK before 3.10.3 Denial of Service via Uncontrolled Recursion
CVE-2026-81723 3.7 LOW NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView
CVE-2026-81725 3.7 LOW NLTK before 3.10.3 Regular Expression Denial of Service via Pl196xCorpusReader

IV. Related Vulnerabilities

Same product: nltk
Same vendor: nltk
Same weakness: CWE-407

V. Comments for CVE-2026-81722

No comments yet

Leave a comment