What is the CVSS score of CVE-2026-12199?

CVE-2026-12199 has a CVSS 3.0 base score of 7.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.5%.

Which versions of NLTK are affected by CVE-2026-12199?

NLTK's WordNet Browser HTTP server (versions through 3.9.3) is vulnerable to unauthenticated remote denial of service, allowing any network-reachable attacker to terminate the server process with a…

How to fix or mitigate CVE-2026-12199?

24 hours: Inventory all systems running nltk.app.wordnet_app and determine network accessibility. 7 days: Implement firewall rules restricting access to the wordnet server to trusted internal networks only; disable the service if not actively required. 30 days: Monitor vendor advisories for NLTK patch release and establish testing plan for deployment.

NLTK CVE-2026-12199

EUVD-2026-37569 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-17 @huntr_ai

Authentication Bypass Denial Of Service Red Hat Nltk Nltk Nltk

7.5

CVSS 3.0 · Vendor: huntr_ai

Severity by source

Vendor (huntr_ai) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network GET to a fixed path triggers immediate process termination with no user interaction; pure availability impact, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (huntr_ai).

CVSS VectorVendor: huntr_ai

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 08:23 vuln.today

DescriptionCVE.org

A vulnerability in nltk.app.wordnet_app up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthenticated GET request (/SHUTDOWN%20THE%20SERVER) to terminate the process immediately via os._exit(0). This results in a denial of service, impacting service availability. The issue arises due to insufficient authentication and protection mechanisms for critical server functions.

AnalysisAI

Unauthenticated remote denial of service in NLTK's WordNet Browser HTTP server (nltk.app.wordnet_app) through version 3.9.3 allows any network-reachable attacker to terminate the server process by sending a single GET request to /SHUTDOWN%20THE%20SERVER. The server binds to all interfaces by default and invokes os._exit(0) on receipt, with no public exploit identified at time of analysis but exploitation is trivial given the documented endpoint.

Technical ContextAI

NLTK (Natural Language Toolkit) is a widely used Python library for natural language processing; its nltk.app.wordnet_app module ships an optional local HTTP browser for exploring the WordNet lexical database. The flaw is a textbook CWE-306 (Missing Authentication for Critical Function): the embedded HTTP server exposes an administrative shutdown route that is dispatched without any credential check or origin validation, and the handler calls os._exit(0) which bypasses normal Python shutdown hooks and terminates the interpreter immediately. CPE coverage (cpe:2.3:a:nltk:nltk) indicates the issue is in the NLTK package itself rather than a downstream redistribution.

RemediationAI

No vendor-released patch identified at time of analysis based on the provided data; monitor the NLTK GitHub repository and the huntr report at https://huntr.com/bounties/cee4ca6a-d17f-4746-abad-c68119633d37 for a fixed release beyond 3.9.3. As compensating controls, avoid running nltk.app.wordnet_app on shared or untrusted networks, and if it must be used, bind it to 127.0.0.1 only (modify the wordnet_app server invocation to use localhost) so external hosts cannot reach the shutdown endpoint - the trade-off is loss of remote browser access. Alternatively restrict access via host firewall rules (e.g., iptables/ufw blocking the WordNet Browser port from non-loopback sources) or front it with an authenticating reverse proxy; treat the tool as a single-user developer utility and do not deploy it in production or multi-tenant environments.