PT-2026-26299 · Nltk · Nltk

Leduckhuong · Published 2026-03-19 · Updated 2026-05-25 · CVE-2026-33231

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.3 and prior

Description NLTK’s nltk.app.wordnet app component allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request to the ''/SHUTDOWN%20THE%20SERVER'' API endpoint causes the process to terminate immediately via the os. exit(0) function, resulting in a denial of service. The vulnerable logic resides in the nltk/app/wordnet app.py file, specifically in the MyServerHandler class. The server listens on all interfaces and checks for the exact path SHUTDOWN THE SERVER. When the server mode is set to False (the default), the handler directly terminates the process.

Recommendations Versions prior to 3.9.3 should be updated to a newer version that includes the fix.

Exploit

Fix

DoS

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-33231

ECHO-05D0-935C-6543

GHSA-JM6W-M3J8-898G

USN-8302-1

Affected Products

Nltk

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33231.json · Exploit
• https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b · Patch
• https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0848 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33231 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-0846 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8302-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jm6w-m3j8-898g · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33231 · Security Note
• https://ubuntu.com/security/CVE-2026-0847 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33231 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-33231 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33236 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33231 · Vendor Advisory