Unauthenticated remote shutdown in nltk.app.wordnet_app
Date: 2026-03
Affected: pip/nltk
Attack vector: dos
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33231
CWE: CWE-306
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

### Summary `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. ### Details The vulnerable logic is in `nltk/app/wordnet_app.py`: - [`nltk/app/wordnet_app.py:242`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L242) - The server listens on all interfaces: - `server = HTTPServer(("", port), MyServerHandler)` - [`nltk/app/wordnet_app.py:87`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L87) - Incoming requests are checked for the exact path: - `if unquote_plus(sp) == "SHUTDOWN THE SERVER":` - [`nltk/app/wordnet_app.py:88`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L88) - The shutdown protection only depends on `server_mode` - [`nltk/app/wordnet_app.py:93`](/mnt/Data/my_brains/test/nltk/nltk/app/wordnet_app.py#L93) - In the default mode (`runBrowser=True`, therefore `server_mode=False`), the handler terminates the process directly: - `os._exit(0)` This means any party that can reach the listening port can stop the service with a single unauthenticated GET request when the browser is started in its normal mode. ### PoC 1. Start the WordNet Browser in Docker in its default mode: ```bash docker run -d --name nltk-wordnet-web-default-retest -p 8004:8004 \ nltk-sandbox \ python -c "import nltk; nlt


Mitigations:

Architectural layers (MAESTRO):