CVE-2026-12199: Unauthenticated Denial of Service in nltk.app.wordnet_app
A vulnerability in nltk.app.wordnetapp up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthenticated GET request (/SHUTDOWN%20THE%20SERVER) to terminate the process immediately via os.exit(0). This results in a denial of service, impacting service availability. The issue arises due to insufficient authentication and protection mechanisms for critical server functions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
nltk.app.wordnet_appfrom your environment.If the WordNet Browser HTTP server is not required, stop running it or uninstall/disable the component to eliminate the exposed unauthenticated management functionality.
- Configuration
Configure the WordNet Browser HTTP server to bind only to localhost instead of listening on all interfaces so it is not reachable remotely in its default mode.
nltk.app.wordnet_app (WordNet Browser HTTP server) listen_address = 127.0.0.1 (bind to localhost) - Configuration
Disable or remove the unauthenticated shutdown GET endpoint (/SHUTDOWN%20THE%20SERVER) so that an unauthenticated request cannot terminate the process via os._exit(0).
nltk.app.wordnet_app (WordNet Browser HTTP server) shutdown_endpoint = disabled - Configuration
Require authentication and authorization for any critical or management endpoints (including those able to stop the server) to prevent unauthenticated access.
nltk.app.wordnet_app (WordNet Browser HTTP server) management_authentication = enabled - Compensating control
Restrict network access to the WordNet Browser HTTP server port using firewall rules or network ACLs so only trusted hosts (or management networks) can reach the service.
- Operational
If the server is currently running and cannot immediately be secured, stop the WordNet Browser HTTP server until configuration changes or other mitigations are applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12199?
The severity of CVE-2026-12199 is rated as high with a score of 7.5.
What type of vulnerability is CVE-2026-12199?
CVE-2026-12199 is an unauthenticated denial of service vulnerability.
How does CVE-2026-12199 affect the nltk.app.wordnet_app?
CVE-2026-12199 allows unauthenticated users to remotely shutdown the local WordNet Browser HTTP server.
How do I fix CVE-2026-12199?
To fix CVE-2026-12199, upgrade nltk to a version later than 3.9.3 where the vulnerability is addressed.
What systems are vulnerable to CVE-2026-12199?
CVE-2026-12199 affects nltk.app.wordnet_app versions up to 3.9.3 when the server is started in its default mode.