CVE-2026-33231: NLTK WordNet App Unauthenticated Remote Shutdown Vulnerability
Summary
CVE-2026-33231: Unauthenticated remote shutdown in nltk.app.wordnet_app. Affects nltk versions < 3.9.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NLTK (Natural Language Toolkit) is a popular Python library used for working with human language data (text). It provides easy-to-use interfaces to over 50 corpora and lexical resources, along with a suite of text processing libraries for classification, tokenization, stemming, tagging, parsing, and more. The NLTK WordNet App is a graphical interface for exploring the WordNet lexical database. However, it has a critical vulnerability that allows unauthenticated users to remotely shut down the HTTP server, leading to denial of service.
Vulnerability Detail
The vulnerability in the NLTK WordNet App arises from the server's default configuration, which allows unauthenticated remote shutdown via a simple HTTP GET request. When the server is started in its default mode, it listens on all interfaces and accepts requests to the path '/SHUTDOWN THE SERVER'. This request triggers an immediate termination of the server process using 'os._exit(0)', resulting in a denial of service. Any user with network access to the server can exploit this vulnerability, making it a significant security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can run the NLTK WordNet App in a restricted environment where it is not accessible from external networks. Alternatively, you can modify the server code to implement authentication or restrict access to the shutdown endpoint.
Conclusion
The NLTK WordNet App has a critical vulnerability that allows unauthenticated remote shutdown of its HTTP server, posing a denial of service risk. Users are advised to update to the latest version of the package to mitigate this issue and consider implementing workarounds if immediate updates are not feasible.
See every vulnerability recorded for nltk →
FAQ
CVE-2026-33231 is a vulnerability in the NLTK WordNet App that allows unauthenticated users to remotely shut down the HTTP server, leading to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If you cannot update the package immediately, consider implementing a workaround by restricting access to the server or running it in a secure environment.
More information about NLTK can be found on its official website at https://www.nltk.org, which includes documentation and resources for users.
References
Related vulnerabilities
Recent vulnerabilities recorded for nltk.
