What’s Vulnerable › Vulnerabilities

CVE-2026-63311: NLTK before 3.10.0 SSRF via DNS Resolution Failure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-22 · updated 2026-10-14
• Weakness: CWE-918

Description

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254).

Affected products

• nltk: before 3.10.0 — fixed in 3.10.0

How to fix

Upgrade to a fixed version: nltk 3.10.0. Check the vendor advisory for mitigations.

References

• https://github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839
• https://www.vulncheck.com/advisories/nltk-before-ssrf-via-dns-resolution-failure

Get alerted when CVE-2026-63311 or the next vulnerability affects your stack