CVE-2026-63311
Received Received - Intake

NLTK SSRF Vulnerability in Path Security Validation

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: VulnCheck

Description
NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-63311
EUVD
EUVD-2026-64334

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nltk nltk to 3.9.4 (inc)
nltk nltk to 3.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63311 is an SSRF vulnerability in NLTK versions 3.9.4 and below. The validate_network_url() function in nltk/pathsec.py fails to properly validate URLs when DNS resolution fails. Instead of blocking requests, it allows them to proceed without IP checks due to an empty list returned by _resolve_hostname(). This bypasses SSRF protections, letting attackers access restricted resources like cloud metadata endpoints.

Detection Guidance

To detect this vulnerability, check if your NLTK version is 3.9.4 or below. Run: pip show nltk. If the version is <=3.9.4, the system is vulnerable. Additionally, monitor network traffic for unexpected outbound requests to cloud metadata endpoints like 169.254.169.254 during DNS resolution failures.

  • Check NLTK version: pip show nltk or pip list | grep nltk
  • Inspect nltk/pathsec.py for the validate_network_url() function and verify if _resolve_hostname() returns empty lists on DNS failures without raising SecurityError.
Impact Analysis

An attacker could exploit this to bypass network restrictions and access internal or cloud services. This includes reaching sensitive endpoints like 169.254.169.254, which may expose metadata or other confidential data. The impact depends on the application's network configuration and exposed services.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive information. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to potential data breaches.

Mitigation Strategies

Immediately upgrade NLTK to version 3.10.0 or later using pip install --upgrade nltk. If upgrading is not possible, implement network-level controls to block outbound requests to sensitive endpoints like 169.254.169.254 and monitor DNS resolution failures.

  • Apply the patch from NLTK's official repository or upgrade to NLTK 3.10.0+.
  • Configure firewalls or network policies to restrict access to cloud metadata endpoints and internal services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63311. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart