Skip to content
Fencer Vulns
high 7.5

CVE-2026-12199 json

Unauthenticated Denial of Service in nltk.app.wordnet_app

published 2026-06-17 4 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-37569

cvss
7.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 25%
public exploits
0
none known

Summary

A vulnerability in `nltk.app.wordnet_app` up to version 3.9.3 allows unauthenticated remote shutdown of the local WordNet Browser HTTP server when started in its default mode. The server listens on all interfaces and processes a specific unauthenticated GET request (`/SHUTDOWN%20THE%20SERVER`) to terminate the process immediately via `os._exit(0)`. This results in a denial of service, impacting service availability. The issue arises due to insufficient authentication and protection mechanisms for critical server functions.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-12199 updated cvss 6.5

nltk: NLTK: Remote unauthenticated denial of service in WordNet Browser HTTP server

  • Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat OpenShift AI (RHOAI) rhoai/odh-ta-lmes-job-rhel9, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9, rhoai/odh-trustyai-nemo-guardrails-server-rhel9, rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9, rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
    affected: workaround, no fix available “Do not expose the NLTK WordNet Browser HTTP server to untrusted networks. Bind the server to localhost only if it must be used. Upgrade to NLTK version 3.9.4 or later when available.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/cee4ca6a-d17f-4746-abad-c68119633d37 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • nltk nltk/nltk

Classification

Weakness
  • CWE-306 Missing Authentication for Critical Functionality

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.