Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-63311 medium CVSS 5.3

SSRF (Server-Side Request Forgery) in nltk (CVE-2026-63311)

Summary

SSRF in nltk (CVE-2026-63311). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to 3.10.0 or later.

Original description

The description as published by the source.

There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validate_network_url() function in nltk/pathsec.py fails open when DNS resolution returns an error.

The _resolve_hostname() helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo() and returns an empty list []. When this happens, the validation loop in validate_network_url() iterates over nothing (for addr in resolved: ... never executes), with no else/fallback check. The function returns normally, and urlopen() proceeds to make the request without any IP validation.

This means:

  1. If DNS is temporarily unavailable, ALL SSRF protections are disabled
  2. DNS rebinding attacks bypass the check after the LRU cache entry expires
  3. In environments with unreliable resolvers, the protection is permanently bypassed

PoC:

import nltk.pathsec
import unittest.mock

# Simulate DNS failure
with unittest.mock.patch('socket.getaddrinfo', side_effect=OSError('DNS unavailable')):
    # This SHOULD raise but doesn't -- fails open
    nltk.pathsec.validate_network_url('http://169.254.169.254/latest/meta-data/')
    # Returns normally, allowing SSRF to cloud metadata

The correct behavior is fail-closed: if DNS resolution fails, the URL should be REJECTED (not allowed). The function should raise an exception or return a failure status when _resolve_hostname() returns an empty list.

This is distinct from CVE-2024-39705 (which addressed pickle deserialization) and CVE-2026-33236 (w…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-63311 has been found in nltk.
Risk of unauthorized operations or information disclosure. CVSS score: 5.3/10.
What to do: upgrade nltk to 3.10.0 or later.
If unsure, ask your IT team or search "nltk CVE-2026-63311" on the vendor's site.

CVE-2026-63311 (nltk) — CWE-918 / CVSS v3 5.3
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Patched: 3.10.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

SSRF (CWE-918) exists in nltk.

📍 Affected scope

Check the vendor advisory for the affected versions of nltk.

🔥 Severity

Severity: Medium (CVSS 5.3/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 3.10.0.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'nltk' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'nltk' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で nltk を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade nltk to 3.10.0

    ステージング環境で 3.10.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

pip nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0"}]}]
PyPI nltk
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details