CVE-2026-63311 NLTK before 3.10.0 SSRF via DNS Resolution Failure
Attackers can bypass SSRF protections in NLTK via DNS failures to access restricted network resources, including cloud metadata endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63311?
CVE-2026-63311 is a medium-severity server-side request forgery vulnerability in nltk, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254).
Weakness: CWE-918
Which versions are affected by CVE-2026-63311?
3 open source packages ship an affected version, including nltk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nltk PyPI | All versions | 3.10.0 |
nltk PyPI | All versions | 3.10.0 |
nltk PyPI | All versions | 3.10.0 |
Products include Nltk Nltk.
How do I fix CVE-2026-63311?
Upgrade nltk to 3.10.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-63311 being exploited?
There is no known exploitation of CVE-2026-63311 in the wild and no public exploit code.
Other vulnerabilities in nltk
- CVE-2026-0848 Arbitrary Code Execution in NLTK StanfordSegmenter via Untrusted JAR Loading
- CVE-2025-14009 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution
- CVE-2026-78683 NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79657 NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserialization
- CVE-2026-79675 NLTK before 3.10.3 JVM Argument Injection via Per-Call Options
Sources
Also known as DEBIAN-CVE-2026-63311, ECHO-2c96-e20c-40c3, GHSA-3gqm-fcw5-w839, MINI-98jg-5c66-g23m, PYSEC-2026-3723, UBUNTU-CVE-2026-63311.