Most recent entries from all

BREW-acronym-CVE-2026-81722 — NLTK: Quadratic-time DoS in PorterStemmer via long runs of 'y'

2026-09-29T18:09:57.751720+00:00

Affected: Homebrew: acronym

`nltk.stem.PorterStemmer.stem()` -- a ubiquitous public API applied to arbitrary, often untrusted, tokens -- runs in O(n^2) time on a token containing a long run of the letter 'y', letting a single ~20-50 KB token pin a CPU core (CWE-407).

## Root cause

`_is_consonant(word, i)` was made *iterative* (commit for #3633, GHSA/CWE-674) to fix an earlier unbounded-recursion `RecursionError` on `'y'*10000`. The iterative form walks *backward* over the whole run of 'y's on every call:

```python while i > 0 and word[i] == 'y': negate = not negate i -= 1 ```

`_measure()` then calls `_is_consonant(stem, i)` once for **every** position `i` of the stem. For a run of n 'y's that is sum_{i} O(i) = O(n^2). The recursion fix therefore traded a CWE-674 RecursionError for a CWE-407 quadratic-time DoS.

## Proof of concept

Measured (Python 3.13): `stem('y'*5000 + 'ness')` = 2.6s, `stem('y'*10000 + 'ness')` = 11.3s (2x input -> ~4.3x time = quadratic), `stem('y'*20000 + 'ness')` > 20s. A pure run of 'y' with no matching suffix is fast because the stemmer rules that call `_measure` do not fire; a real suffix such as 'ness' triggers `_measure` on the long stem.

```python from nltk.stem import PorterStemmer PorterStemmer().stem('y' * 20000 + 'ness') # >20s of CPU ```

## Impact

Stemming is routinely applied to untrusted text (search, indexing, NLP pipelines). A single unbroken ~20-50 KB token of 'y' characters (no whitespace, so it survives tokenization) causes multi-second-to-minu…

fkie_cve-2026-81722

2026-09-29T18:09:57.751851+00:00

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.

Withdrawn: GHSA-8x48-8g7j-rqxp — Duplicate Advisory: Quadratic-time DoS in PorterStemmer via long runs of 'y'

2026-09-29T18:09:57.751905+00:00

Withdrawn by the publisher.

Affected: PyPI: nltk

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-ww6m-cw3f-q94g. This link is maintained to preserve external references.

## Original Description nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.

PYSEC-2026-3738

2026-09-29T18:09:57.751952+00:00

Affected: PyPI: nltk

RHSA-2026:69539 — Red Hat Security Advisory: RHOAI 3.5.1 - Red Hat OpenShift AI

2026-09-29T18:09:57.751985+00:00

sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue sqlparse: sqlparse: Denial of Service via inefficient SQL parsing nltk: NLTK: Information Disclosure via Symlink Sandbox Bypass aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in comment grouping github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors nltk: NLTK: Denial of Service via unvalidated regular expressions nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing nltk: NLTK: Denial of Service via Uncontrolled Recursion nltk: NLTK: Filesystem containment bypass allows local file overwrite

UBUNTU-CVE-2026-81722

2026-09-29T18:09:57.752048+00:00

Affected: Ubuntu:Pro:14.04:LTS: nltk, Ubuntu:Pro:16.04:LTS: nltk, Ubuntu:Pro:18.04:LTS: nltk, Ubuntu:Pro:20.04:LTS: nltk, Ubuntu:Pro:22.04:LTS: nltk, Ubuntu:Pro:24.04:LTS: nltk, Ubuntu:Pro:26.04:LTS: nltk