7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33231

CVE-2026-33231: NLTK has unauthenticated remote shutdown in nltk.app.wordnet_app

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnet_app allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os._exit(0), resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33231

CVE-2026-33231:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nltk	pip	<= 3.9.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unauthenticated remote denial of service in the nltk.app.wordnet_app module. The root cause is a combination of two main issues. First, the wnb function, which starts the WordNet browser server, configured the underlying HTTPServer to listen on all network interfaces (0.0.0.0). This exposed the server to remote connections. Second, the MyServerHandler.do_GET method, which handles all GET requests, included a hidden feature to shut down the server. A request to the path /SHUTDOWN%20THE%20SERVER would trigger a call to os._exit(0), immediately terminating the server process. This shutdown mechanism had no authentication.

An attacker who could reach the server's port over the network could send a simple, unauthenticated GET request to shut it down, leading to a denial of service. The vulnerability is particularly easy to exploit. The fix for this vulnerability was to change the server's listening address in the wnb function from "" to "127.0.0.1", ensuring that the server is only accessible from the local machine, thus mitigating the remote threat.

Vulnerable functions

MyServerHandler.do_GET

nltk/app/wordnet_app.py

This function handles incoming GET requests. It contains a check for the path "/SHUTDOWN THE SERVER". If this path is requested and the server is not in 'server_mode', it calls `os._exit(0)`, immediately terminating the server process without any authentication. This allows an unauthenticated user to cause a denial of service.

wnb

nltk/app/wordnet_app.py

This function is responsible for initializing and starting the HTTP server. The vulnerability description indicates that in the vulnerable version, the server was bound to all interfaces (''). This made the unauthenticated shutdown functionality in `MyServerHandler.do_GET` remotely accessible. The patch, visible in the fetched source code, changed this to bind to '127.0.0.1', limiting access to the local machine.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.