Fluid Attacks Database

Description

A vulnerability in nltk.app.wordnet_app up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthenticated GET request (/SHUTDOWN%20THE%20SERVER) to terminate the process immediately via os._exit(0). This results in a denial of service, impacting service availability. The issue arises due to insufficient authentication and protection mechanisms for critical server functions.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 11	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.5-1 \|\| =3.6.5-1 \|\| =3.6.7-1 \|\| =3.7-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1
debian 14	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1
debian 12	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1
debian 13	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1

Aliases

1. CVE-2026-121992. NVD-2026-121993. OSV-DEBIAN-2026-121994. OSV-2026-121995. SECURITY-TRACKER-CVE-2026-12199

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.