Unauthenticated Remote Shutdown Vulnerability in NLTK WordNet Browser

CVE-2026-12199

What is CVE-2026-12199?

A vulnerability exists in the NLTK WordNet Browser, allowing unauthenticated users to remotely shut down the local HTTP server. When the server operates in its default configuration, it listens for all network interfaces and can be targeted with a specific unauthenticated GET request (/SHUTDOWN%20THE%20SERVER). This request leads to an immediate termination of the server process via a direct operating system call, resulting in Denial of Service and affecting the availability of the service. The root cause lies in inadequate authentication safeguards and insufficient protection for essential server functionalities.

References