CVE-2026-33231

What it actually does

In NLTK 3.9.3 and earlier, the WordNet Browser HTTP server started via nltk.app.wordnet_app accepts an unauthenticated HTTP GET that immediately terminates the process with os._exit(0). Confidentiality and integrity of data are not affected; the impact is complete loss of availability of that local browser process. The service has no authentication in its default mode, so any network-reachable instance can be shut down without credentials.

Why it matters to the business

Teams that run the WordNet Browser as a shared or network-reachable helper for NLP research, teaching, or development can lose that service instantly, interrupting workflows until it is restarted. This is not listed in CISA KEV and is not associated with ransomware campaigns; exploit maturity is none. EPSS is modest (~0.015) but rose about 67% over 30 days, so exposure should still be treated as an availability risk for any host that binds the browser beyond localhost. Downstream use of NLTK is common in Python NLP stacks, so unpatched developer and lab environments remain the primary operational concern rather than typical internet-facing production apps.

How an attack unfolds

An attacker who can reach the WordNet Browser HTTP port sends a single unauthenticated request that the application treats as a privileged shutdown command. Because default mode does not require authentication or a confirmed local operator, the server process exits immediately. The result is a remote denial of service of the browser only; the attacker does not gain code execution, data access, or persistence. No named threat actors are reported as exploiting this CVE.

How to fix it

Upgrade NLTK past 3.9.3 so that it includes commit bbaae83db86a0f49e00f5b0db44a7254c268de9b (or a later release that contains that fix). Until packages are updated, do not start nltk.app.wordnet_app in default network-exposed mode; bind it only to loopback if it must run, restrict access with host firewalls, and treat the shutdown control as an authenticated, local-only operation. Inventory Python environments, notebooks, and teaching images that pin nltk<=3.9.3 and replace those pins.

How to confirm the fix worked

Confirm installed nltk is newer than 3.9.3 and that the WordNet Browser code matches the patched commit. Verify the service, if still used, is not listening on non-loopback interfaces. After upgrade, confirm unauthenticated shutdown requests no longer terminate the process and that only intended local operators can stop the server. Search estate-wide for running wordnet_app processes and outdated nltk wheels in virtualenvs, containers, and CI images.

Typical attack path

1. Identify a host running the NLTK WordNet Browser HTTP server in default (unauthenticated) mode and reachable on the network.
2. Send an unauthenticated HTTP request to the server's documented shutdown path.
3. The process calls os._exit(0) and terminates, denying service until an operator restarts it.
4. Optionally repeat after restart to keep the helper unavailable.

How to detect it

This issue causes process death, not malware implant, so look for availability artifacts rather than post-exploitation implants. Review HTTP access logs and reverse-proxy logs for requests to the WordNet Browser whose path or query indicates a shutdown command, especially from non-local clients. Correlate with unexpected exit of Python processes running nltk.app.wordnet_app, systemd/journal or container restart events, and brief listeners on the WordNet Browser port disappearing. There are no reported APT campaigns; treat matching logs as likely opportunistic or accidental DoS. Network captures showing a single unauthenticated GET followed by TCP close and process termination are consistent with abuse.

• GET /SHUTDOWN%20THE%20SERVER
• SHUTDOWN THE SERVER
• nltk.app.wordnet_app
• os._exit(0)

What your security team should do

• Patch or upgrade NLTK above 3.9.3 in all developer, lab, and CI images that include the toolkit.
• Ensure WordNet Browser is not reachable from untrusted networks; restrict to localhost or disable it if unused.
• Hunt for historical unauthenticated shutdown requests against WordNet Browser listeners even though KEV and ransomware flags are false.
• Add nltk version and wordnet_app process checks to vulnerability and software-composition scans given NLTK's prevalence in NLP ecosystems.
• Reassess exposure if EPSS continues to rise, but do not treat this as a production remote-code-execution emergency.