Homepage

Missing Authentication for Critical Function Affecting nltk package, versions *

Severity

 Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
1.24% (69th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU2610-NLTK-21208542
  • published18 Oct 2026
  • disclosed20 Mar 2026
Report a new vulnerability Found a mistake?

Introduced: 20 Mar 2026

CVE-2026-33231  (opens in a new tab)
CWE-306  (opens in a new tab)

How to fix?

There is no fixed version for Ubuntu:26.10 nltk.

NVD Description

Note: Versions mentioned in the description apply only to the upstream nltk package and not the nltk package as distributed by Ubuntu. See How to fix? for Ubuntu:26.10 relevant fixed versions and status.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnet_app allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os._exit(0), resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.