CVE-2026-63311

Medium

Description

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254).

SeverityMedium

CVSS5.3

Exploit probability—

ProductNltk

PublishedAug 22, 2026

First seenAug 22, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Update

nltk nltk3.10.0 or later
nltk3.10.0 or later

Vendor advisories

github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839

Affected products

Product	Affected versions	Fixed in
nltk nltk	v < 3.10.0	3.10.0
nltkPyPI	v < 3.10.0	3.10.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.