Untriaged
Permalink
CVE-2026-33231
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): HIGH
NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.
References
- https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g x_refsource_CONFIRM
- https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b x_refsource_MISC
Affected products
nltk
- ==<= 3.9.3
Matching in nixpkgs
pkgs.python312Packages.nltk
Natural Language Processing ToolKit
pkgs.python313Packages.nltk
Natural Language Processing ToolKit
pkgs.python314Packages.nltk
Natural Language Processing ToolKit
Package maintainers
-
@bengsparks Ben Sparks <benjamin.sparks@protonmail.com>