EUVD-2026-67072
GHSA-8x48-8g7j-rqxp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via any exposing application, no authentication or interaction required; impact is pure availability with no confidentiality or integrity consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact.
AnalysisAI
CPU-pinning denial of service in NLTK's PorterStemmer component (versions ≤ 3.10.2) allows a remote unauthenticated attacker to exhaust a CPU core for seconds to minutes by submitting a single crafted token. The root cause is quadratic algorithmic complexity: _is_consonant() re-walks trailing 'y' characters on every invocation, and _measure() calls it once per stem position, resulting in O(n²) processing time. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application calls NLTK's PorterStemmer.stem() on text that includes attacker-controlled tokens without enforcing a maximum token length. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) scores 8.7, reflecting that the attack requires no authentication, no special network position, and no user interaction - consistent with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a public-facing web service that accepts free-text input (e.g., a search field, a text analysis API) backed by NLTK's PorterStemmer for term normalization. The attacker submits a single HTTP request containing a token of approximately 30,000 'y' characters followed by the suffix 'ness', causing PorterStemmer.stem() to enter a quadratic computation loop that pins a CPU core for tens of seconds. … |
| Remediation | The primary fix is to upgrade NLTK to version 3.10.3 or later, which resolves the quadratic complexity in PorterStemmer per the vendor security advisory GHSA-ww6m-cw3f-q94g (https://github.com/nltk/nltk/security/advisories/GHSA-ww6m-cw3f-q94g). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems and applications using NLTK version 3.10.2 or earlier by reviewing Python dependencies and container images in production environments; prioritize services that process untrusted user input (search, chatbots, analytics APIs). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Arbitrary code execution in the NLTK (Natural Language Toolkit) Python library affects all versions through its data dow
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research a
nltk is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is r
NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a .
Arbitrary code execution in NLTK (Natural Language Toolkit) through 3.9.4 allows attackers to run Python code when a vic
Argument injection in the Natural Language Toolkit (NLTK) Python library before 3.10.3 allows attackers who control the
Arbitrary code injection in the Natural Language Toolkit (NLTK) before 3.9.3 stems from the downloader module extracting
Arbitrary code execution in the Natural Language Toolkit (NLTK) before 3.10.3 allows attackers to bypass the library's p
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a c
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() direc
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to
Path traversal in NLTK before 3.10.3 exposes arbitrary filesystem content and SQLite databases by bypassing the library'
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today