PYSEC-2026-2236

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/nltk/PYSEC-2026-2236.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-2236

Aliases

Published

2026-03-20T23:16:46.850Z

Modified

2026-07-13T07:15:50.554652709Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, nltk.app.wordnet_app allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os._exit(0), resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.

References

Affected packages

PyPI / nltk

Package

Name: nltk; View open source insights on deps.dev
Purl: pkg:pypi/nltk

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.9.4

Affected versions

2.*

2.0.1rc2-git

2.0b4

2.0b5

2.0b6

2.0b7

2.0b8

2.0b9

2.0.1rc1

2.0.1rc3

2.0.1rc4

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

0.*

0.8

0.9

0.9.3

0.9.4

0.9.5

0.9.6

0.9.7

0.9.8

0.9.9

3.*

3.0.0b1

3.0.0b2

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.0.5

3.1

3.2

3.2.1

3.2.2

3.2.3

3.2.4

3.2.5

3.3

3.4

3.4.1

3.4.2

3.4.3

3.4.4

3.4.5

3.5b1

3.5

3.6

3.6.1

3.6.2

3.6.3

3.6.4

3.6.5

3.6.6

3.6.7

3.7

3.8

3.8.1

3.9b1

3.9

3.9.1

3.9.2

3.9.3

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/nltk/PYSEC-2026-2236.yaml"