CVE-2026-33231 NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app
An unauthenticated remote attacker can shut down the local WordNet Browser HTTP server by sending a specific GET request, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33231?
CVE-2026-33231 is a high-severity missing authorization vulnerability in nltk, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.
Weakness: CWE-306
Which versions are affected by CVE-2026-33231?
3 open source packages ship an affected version, including nltk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nltk PyPI | All versions | 3.9.4 |
nltk PyPI | All versions | 3.9.4 |
nltk PyPI | All versions | 3.9.4 |
Products include Nltk Nltk.
How do I fix CVE-2026-33231?
Upgrade nltk to 3.9.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-33231 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33231 exists.
Other vulnerabilities in nltk
- CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading
- CVE-2025-14009 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution
- CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options
Sources
Also known as DEBIAN-CVE-2026-33231, ECHO-05d0-935c-6543, GHSA-jm6w-m3j8-898g, MINI-rq22-v2h9-29q3, PYSEC-2026-2236, ROOT-APP-PYPI-CVE-2026-33231.