CVE-2026-33231

Fixed in a distro release EPSS 1%CVSS 7.5

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.

Published 2026-03-20 · CVE record · OSV

Products: nltk, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat Lightspeed Core, Red Hat OpenShift Lightspeed, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI)

Fixed upstream

Distro releases