CVE-2026-81722: NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'
nltk.stem.PorterStemmer.stem() – a ubiquitous public API applied to arbitrary, often untrusted, tokens – runs in O(n^2) time on a token containing a long run of the letter ‘y’, letting a single ~20-50 KB token pin a CPU core (CWE-407).
References
- github.com/advisories/GHSA-ww6m-cw3f-q94g
- github.com/nltk/nltk/commit/7808692d451b962711005d954859bb83aabcf8fa
- github.com/nltk/nltk/releases/tag/v3.10.3
- github.com/nltk/nltk/security/advisories/GHSA-ww6m-cw3f-q94g
- github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3738.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-81722
- www.vulncheck.com/advisories/nltk-porterstemmer-before-3.10.3-quadratic-time-dos
Code Behaviors & Features
Detect and mitigate CVE-2026-81722 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →