The wordnet_app component of the NLTK library contains a flaw that allows an unauthenticated user to terminate the WordNet Browser HTTP server by requesting the special URL /SHUTDOWN THE SERVER. Because the request is accepted on all network interfaces and triggers os._exit(0), the server process is brought down immediately, causing a denial of service. This weakness arises from a missing security check (CWE‑306).

The issue affects versions of the NLTK library (nltk/nltk) through 3.9.3. Users running any of these releases with the default WordNet Browser HTTP server configuration are vulnerable.

With a CVSS score of 6.5 the vulnerability is classified as medium severity. The EPSS score of less than 1 % suggests that exploitation is unlikely at present, and it is not listed in the CISA KEV catalog. Nonetheless, the attack can be launched remotely against any instance where the server is listening on an externally reachable interface; the attacker merely needs to send an unauthenticated GET request targeting /SHUTDOWN THE SERVER.