CVE-2026-63311

NLTK before 3.10.0 SSRF via DNS Resolution Failure

Published Aug 22, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254).

Analysis

Technical impact

The NLTK library before version 3.10.0 contains a server‑side request forgery flaw in the validate_network_url function. When DNS resolution fails, the function mistakenly skips IP validation and allows urlopen() to proceed unchecked. This flaw can be exploited by an attacker who supplies a malicious URL or induces a DNS failure, enabling access to internal or private network endpoints, including cloud metadata services such as 169.254.169.254, thereby compromising confidentiality and potentially integrity.

Affected Systems

The issue impacts NLTK releases from the nltk:nltk vendor, specifically any version up to and including 3.9.4. Systems that use the validate_network_url routine to process user‑supplied URLs are at risk.

Risk and Exploitability

The CVSS base score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires the ability to trigger DNS resolution failure or DNS rebinding against NLTK’s internal validation logic. Based on the description, the likely attack vector is application‑level input that causes the library to fetch a URL whose hostname cannot be resolved, allowing the attacker to reach restricted network resources.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

nltk

unaffected

Version	Status	Constraints
`0`	affected	< 3.10.0
`3.10.0`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:nltk:nltk:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Nltk

Version	Status	Scheme	Platform
`[0,3.10.0)`	affected	semver	—
`3.10.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade NLTK to version 3.10.0 or later, which removes the flawed validation path.
Add explicit input validation or a whitelist around calls to nltk.pathsec.validate_network_url to limit which URLs may be fetched.
Configure network controls (firewall or proxy) to restrict outbound connections from the application to internal addresses such as the 169.254.169.254 cloud metadata endpoint.

Generated by OpenCVE AI on August 22, 2026 at 15:27 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-3gqm-fcw5-w839	NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact Low

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.334% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839
https://nvd.nist.gov/vuln/detail/CVE-2026-63311
https://www.cve.org/CVERecord?id=CVE-2026-63311
https://www.vulncheck.com/advisories/nltk-before-ssrf-via-dns-resolution-failure

History

Aug 28, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 27, 2026 6:00 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-63311 https://www.cve.org/CVERecord?id=CVE-2026-63311
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 22, 2026 2:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254).
Title		NLTK before 3.10.0 SSRF via DNS Resolution Failure
First Time appeared		Nltk Nltk nltk
Weaknesses		CWE-918
CPEs		cpe:2.3:a:nltk:nltk::::::::
Vendors & Products		Nltk Nltk nltk
References		https://github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839 https://www.vulncheck.com/advisories/nltk-before-ssrf-via-dns-resolution-failure
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L'}`