PT-2026-26299 · Nltk+2 · Nltk+2

Leduckhuong · Publicado 2026-03-19 · Atualizado 2026-06-03 · CVE-2026-33231

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.3 and prior

Description NLTK’s nltk.app.wordnet app component allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request to the ''/SHUTDOWN%20THE%20SERVER'' API endpoint causes the process to terminate immediately via the os. exit(0) function, resulting in a denial of service. The vulnerable logic resides in the nltk/app/wordnet app.py file, specifically in the MyServerHandler class. The server listens on all interfaces and checks for the exact path SHUTDOWN THE SERVER. When the server mode is set to False (the default), the handler directly terminates the process.

Recommendations Versions prior to 3.9.3 should be updated to a newer version that includes the fix.

Exploit

Correção

DoS

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-33231

ECHO-05D0-935C-6543

GHSA-JM6W-M3J8-898G

USN-8302-1

Produtos afetados

Linuxmint

Nltk

Ubuntu

Referências · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33231.json · Exploit
• https://github.com/nltk/nltk · Nota
• https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b · Correção
• https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33231 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33231 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-0848 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-33230 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-33236 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-33231 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-8302-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-0847 · Aviso do Fabricante
• https://reddit.com/r/VulnMatter/comments/1ry0nlu/resumen_diario_de_vulnerabilidades_19032026 · Publicação no Reddit
• https://ubuntu.com/security/CVE-2026-33231 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33231 · Nota de Segurança