Fluid Attacks Database

Description

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnet_app allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os._exit(0), resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
pypi	nltk	>=0 <3.9.4	3.9.4
debian 11	nltk	=3.5-1 \|\| =3.6.5-1 \|\| =3.6.7-1 \|\| =3.7-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 12	nltk	=3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 13	nltk	=3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 14	nltk	=3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-

Aliases

1. CVE-2026-332312. NVD-2026-332313. OSV-2026-332314. OSV-DEBIAN-2026-332315. GHSA-jm6w-m3j8-898g6. GCVE-2026-332317. SECURITY-TRACKER-CVE-2026-33231

References

1. https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g2. https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b