CVE-2026-63311

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0

Description A server-side request forgery (SSRF) issue exists in the validate network url() function within nltk/pathsec.py. The resolve hostname() helper function catches OSError and ValueError during socket.getaddrinfo() and returns an empty list. If DNS resolution fails, the validation loop performs no IP checks, causing the function to fail open and allowing urlopen() to proceed without validation. This allows an attacker to bypass SSRF protections via DNS rebinding or by triggering DNS resolution failures to access restricted network resources, such as cloud metadata endpoints.

Recommendations Update to version 3.10.0 or later. As a temporary mitigation, restrict the use of the validate network url() function until the update is applied.