---
id: CVE-2026-63311
title: >-
  NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request
  forgery (SSRF) vulnerability in the validate_network_url() function in
  nltk/pathsec.py
summary: >-
  NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request
  forgery (SSRF) vulnerability in the validate_network_url() function in
  nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError
  during s…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-918
published: '2026-08-22'
updated: '2026-08-22'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63311'
references:
  - url: 'https://github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/nltk-before-ssrf-via-dns-resolution-failure
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-08-23T04:42:15.315Z'
epss: 0.00334
epssPercentile: 0.24137
---

## Overview

NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.