Description
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nltk | nltk | <= 3.9.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nltk | 3.10.0-1 | — |
| Debian 13 | nltk | No fix yet | — |
| Debian 12 | nltk | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | nltk | No fix yet | — |
| Ubuntu 25.10 | nltk | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | nltk | 3.9.2-1ubuntu0.1~esm2 | — |
| Ubuntu Pro 24.04 LTS | nltk | 3.8.1-1ubuntu0.1~esm2 | — |
| Ubuntu Pro 22.04 LTS | nltk | 3.7-1ubuntu0.1~esm2 | — |
| Ubuntu Pro 20.04 LTS | nltk | 3.4.5-2ubuntu0.1~esm4 | — |
| Ubuntu Pro 18.04 LTS | nltk | 3.2.5-1ubuntu0.1+esm4 | — |
| Ubuntu Pro 16.04 LTS | nltk | 3.1-1ubuntu0.1+esm4 | — |
| Ubuntu Pro 14.04 LTS | nltk | 2.0~b9-0ubuntu4.1~esm6 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.16.0-r3 | — |
| Wolfi rolling | open-webui | 0.8.12-r1 | — |
| Wolfi rolling | py3-nltk +3 | 3.9.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nltk | < 3.9.4 | 3.9.4 | GHSA-jm6w-m3j8-898g |
Advisories 1
- WID-SEC-2026-0895 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 19, 2026