CVE-2026-33231 - Vulnerability Analysis

Overview

NLTK <= 3.9.3 contains a denial of service caused by unauthenticated remote shutdown via a crafted GET request in nltk.app.wordnet_app HTTP server, letting remote attackers terminate the server process immediately.

Severity & Score

Impact

Remote attackers can cause the WordNet Browser HTTP server to terminate, resulting in denial of service.

Mitigation

Update to a version after 3.9.3 that includes commit bbaae83db86a0f49e00f5b0db44a7254c268de9b or the latest version.

References

• https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b
• https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 22, 2026

🟠 CVE-2026-33231 - High (7.5) NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remot... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33231/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner