CVE-2026-33231: NLTK unauthenticated remote shutdown in WordNet Browser

CVE-2026-33231 · Severity: high · CVSS 7.5 · Published 2026-03-20

The Natural Language Toolkit (NLTK) is a popular Python library used for processing human language data. A vulnerability in its WordNet Browser component allows an unauthenticated person to remotely shut down the server with a single web request. This can lead to a denial of service, making the tool unavailable for researchers or applications relying on its web interface.

Technologies: nltk (PyPI), Red Hat Lightspeed Core, Red Hat OpenShift Lightspeed. Vendors: PyPI, Red Hat.

Quick answers

Is CVE-2026-33231 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33231 being exploited in the wild.
How severe is CVE-2026-33231?
High severity, with a CVSS score of 7.5, published 20 March 2026.
Which products and versions are affected?
nltk (PyPI) <= 3.9.3, ECOSYSTEM:introduced=0,fixed=3.9.4.
Is there a fix for CVE-2026-33231?
Yes. nltk (PyPI): upgrade to 3.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33231 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33231?
Check whether you run nltk (PyPI), Red Hat Lightspeed Core or Red Hat OpenShift Lightspeed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nltk (PyPI): upgrade to 3.9.4 or later
    pip install "nltk>=3.9.4"

Technical details

The `nltk.app.wordnet_app` component in NLTK versions up to and including 3.9.3 fails to implement authentication for critical server functions. By default, the WordNet Browser HTTP server listens on all interfaces (`0.0.0.0`). An attacker can send a specially crafted HTTP GET request to the `/SHUTDOWN%20THE%20SERVER` endpoint, which triggers an immediate `os._exit(0)` call. This results in a complete process termination and denial of service. The issue is addressed in later versions by binding the server to localhost (`127.0.0.1`) by default and patching the shutdown logic.

Affected products

  • nltk nltk <= 3.9.3
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Lightspeed Core
  • Red Hat OpenShift Lightspeed
  • Red Hat Red Hat Ansible Automation Platform 2

Identifiers

  • CVE-2026-33231
  • GHSA-jm6w-m3j8-898g
  • PYSEC-2026-2236

Timeline

  • 2026-03-18: advisory: GitHub Security Advisory published
  • 2026-03-20: disclosed: CVE published to NVD
  • 2026-05-20: patched: Red Hat released security advisory RHSA-2026:19712

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.