Most recent entries from all

CVE-2026-33231 — NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

2026-09-29T20:57:02.775539+00:00

Affected: nltk, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Lightspeed Core, Red Hat OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI)

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.

GHSA-jm6w-m3j8-898g — Unauthenticated remote shutdown in nltk.app.wordnet_app

2026-09-29T20:57:02.775711+00:00

Affected: PyPI: nltk

### Summary `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service.

### Details The vulnerable logic is in `nltk/app/wordnet_app.py`:

- [`nltk/app/wordnet_app.py:242`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L242) - The server listens on all interfaces: - `server = HTTPServer(("", port), MyServerHandler)`

- [`nltk/app/wordnet_app.py:87`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L87) - Incoming requests are checked for the exact path: - `if unquote_plus(sp) == "SHUTDOWN THE SERVER":`

- [`nltk/app/wordnet_app.py:88`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L88) - The shutdown protection only depends on `server_mode`

- [`nltk/app/wordnet_app.py:93`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L93) - In the default mode (`runBrowser=True`, therefore `server_mode=False`), the handler terminates the process directly: - `os._exit(0)`

This means any party that can reach the listening port can stop the service with a single unauthenticated GET request when the browser is started in its normal mode.

### PoC 1. Start the WordNet Browser in Docker in its default mode:

```bash docker run -d --name nltk-wordnet-web-default-retest -p 8004:8004 \ nltk-sandbox \ python -c "import nltk; nl…

PYSEC-2026-2236

2026-09-29T20:57:02.775813+00:00

Affected: PyPI: nltk