The NLTK library before version 3.10.0 contains a server‑side request forgery flaw in the validate_network_url function. When DNS resolution fails, the function mistakenly skips IP validation and allows urlopen() to proceed unchecked. This flaw can be exploited by an attacker who supplies a malicious URL or induces a DNS failure, enabling access to internal or private network endpoints, including cloud metadata services such as 169.254.169.254, thereby compromising confidentiality and potentially integrity.

The issue impacts NLTK releases from the nltk:nltk vendor, specifically any version up to and including 3.9.4. Systems that use the validate_network_url routine to process user‑supplied URLs are at risk.

The CVSS base score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires the ability to trigger DNS resolution failure or DNS rebinding against NLTK’s internal validation logic. Based on the description, the likely attack vector is application‑level input that causes the library to fetch a URL whose hostname cannot be resolved, allowing the attacker to reach restricted network resources.