Server-Side Request Forgery Vulnerability in NLTK by NLTK Project
CVE-2026-63311

6.9MEDIUM

Key Information:

Vendor

Nltk

Status
Nltk
Vendor
CVE Published:
22 August 2026

What is CVE-2026-63311?

NLTK versions prior to 3.10.0 contain a server-side request forgery (SSRF) vulnerability in the validate_network_url() function. This issue arises when the _resolve_hostname() helper encounters DNS resolution failures, resulting in an empty list being returned instead of blocking the request. Consequently, this allows attackers to exploit DNS rebinding or trigger DNS failures, bypassing SSRF protections and accessing restricted resources such as cloud metadata endpoints, leading to potential data breaches and unauthorized access.

Affected Version(s)

nltk 0 < 3.10.0

nltk 3.10.0

References

https://github.com/nltk/nltk/security/advisories/GHSA-3gq...
vendor-advisory
https://www.vulncheck.com/advisories/nltk-before-ssrf-via...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.