Vulnerability record · CVE-2026-81722 · published 27 August 2026

CVE-2026-81722: Nltk vulnerability

Nltk · Nltk

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.

8.7 CVSS 4.0 High EPSS 0.52% · top 58.1% CWE-407 · CWE-407

8.7CVSS 4.0 base score

0.52%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 2 tagged exploit

31 Aug 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Nltk Nltk

References

Link	Tags
https://github.com/nltk/nltk/security/advisories/GHSA-ww6m-cw3f-q94g	ExploitVendor Advisory
https://www.vulncheck.com/advisories/nltk-porterstemmer-before-3.10.3-quadratic-time-dos	Third Party Advisory
https://github.com/nltk/nltk/security/advisories/GHSA-ww6m-cw3f-q94g	ExploitVendor Advisory

Track CVE-2026-81722 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-0848Nltk improper input validation vulnerabilityNLTK versions <=3.9.2 are vulnerable to arbitrary code execution due to improper input validation in the StanfordSegmenter module. The module dynamic…EPSS 0.81%5 Mar 2026 9.4CVE-2026-78683Nltk deserialization of untrusted data vulnerabilityNLTK before 3.10.0 (affected versions <=3.9.4) contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse() method (nltk/p…EPSS 0.51%25 Aug 2026 9.3CVE-2026-79675Nltk argument injection vulnerabilityNLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject d…EPSS 0.78%25 Aug 2026 9.3CVE-2026-79657Nltk deserialization of untrusted data vulnerabilityNLTK versions before 3.10.3 contain a remote code execution vulnerability in allowlisted pickle loaders that trust entire module namespaces instead o…EPSS 1.3%25 Aug 2026 8.8CVE-2026-79674Nltk vulnerabilityNLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the…EPSS 0.39%25 Aug 2026 8.8CVE-2025-14009Nltk code injection vulnerabilityA critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py…EPSS 0.95%18 Feb 2026 8.7CVE-2026-80205Nltk inefficient regular expression (redos) vulnerabilityNLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that a…EPSS 0.65%26 Aug 2026 8.7CVE-2026-78681Nltk vulnerabilityNLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers …EPSS 0.52%25 Aug 2026

Source: NIST National Vulnerability Database (record CVE-2026-81722), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.