Threats tagged 'brew-acronym-cve-2026-81722'

The NLTK PorterStemmer's stem() function exhibits a quadratic-time denial-of-service (DoS) vulnerability when processing tokens containing long runs of the letter 'y'. This occurs because the consonant-checking function walks backward over the run of 'y's on every call, resulting in O(n^2) time complexity for a run of length n. An attacker can exploit this by submitting a single large token (~20-50 KB) of 'y' characters with a suffix like 'ness', causing multi-second to minute CPU consumption and impacting availability. There is no confidentiality or integrity impact. A fix is available in version 2.0.0_5 that changes the consonant classification to linear time.