Review reviewHigh

CVE-2026-33231

nltk nltk, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, `nltk.app.wordnet_app` allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple `GET /SHUTDOWN%20THE%20SERVER` request causes the process to terminate immediately via `os._exit(0)`, resulting in a denial of service. Commit bbaae83db86a0f49e00f5b0db44a7254c268de9b patches the issue.

CVSS: 7.5
EPSS: 0.88%
CISA KEV: Not listed
Published: 2026.03.21

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.88%

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: nltk nltk, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3
Affected versions: >= <= 3.9.3, <= 3.9.3
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that nltk nltk, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3 and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-306