https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:35:24 +0000 https://vulnerability.circl.lu/vuln/cve-2026-81722 <p><strong>Affected:</strong> nltk</p> <p>nltk PorterStemmer in versions &lt;= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing &#39;y&#39; characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter &#39;y&#39; followed by a matching suffix (e.g., &#39;ness&#39;) can pin a CPU core for seconds to minutes, causing availability impact.</p> <p><strong>Affected:</strong> nltk</p> <p>nltk PorterStemmer in versions &lt;= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing &#39;y&#39; characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter &#39;y&#39; followed by a matching suffix (e.g., &#39;ness&#39;) can pin a CPU core for seconds to minutes, causing availability impact.</p> https://vulnerability.circl.lu/vuln/cve-2026-81722