CVE-2026-33231
High
Description
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNltk
PublishedMar 20, 2026
First seenMar 20, 2026
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- nltk3.9.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nltk nltk | v ≤ 3.9.3 | — |
| nltkPyPI | v < 3.9.4 | 3.9.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.