CVE-2026-63311
NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py. The _resolve_hostname() helper catches OSError and ValueError during socket.getaddrinfo() and returns an empty list; when DNS resolution fails, the validation loop executes no IP checks and the function fails open, allowing urlopen() to proceed without validation. An attacker who can trigger DNS resolution failures or use DNS rebinding can bypass SSRF protections and reach restricted network resources, including cloud metadata endpoints (e.g., 169.254.169.254).
- Affected products
- Nltk
- CVSS 4.0
- 6.9 MEDIUM
- CVSS 3.1
- 5.3 MEDIUM
- EPSS
- 0.2% (16th percentile)
- Weakness
- CWE-918
- NVD status
- Awaiting Analysis
- Published
- 2026-08-22
No indexed exploits for CVE-2026-63311 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-63311 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.