DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63311: CVE-2026-63311: Server-Side Request Forgery and DNS Rebinding in Natural Language Toolkit (NLTK)

#security #cve #cybersecurity

CVE-2026-63311: Server-Side Request Forgery and DNS Rebinding in Natural Language Toolkit (NLTK)

Vulnerability ID: CVE-2026-63311
CVSS Score: 6.9
Published: 2026-09-02

A vulnerability in the Natural Language Toolkit (NLTK) before version 3.10.0 allowed attackers to bypass SSRF filters via DNS resolution failures and DNS rebinding. By exploiting these weaknesses, unauthenticated remote attackers could coerce hosting systems into scanning internal networks or accessing sensitive cloud metadata endpoints.

TL;DR

NLTK versions prior to 3.10.0 are vulnerable to Server-Side Request Forgery (SSRF) and DNS rebinding. Due to fail-open exception handling in DNS resolution and a lack of IP pinning, security checks on remote URLs can be completely bypassed by attackers controlling the target server or domain.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-918
  • Attack Vector: Network
  • CVSS v4.0 Score: 6.9
  • EPSS Score: 0.00241
  • Exploit Status: Proof of Concept
  • CISA KEV Status: No

Affected Systems

  • Python environments utilizing the nltk library
  • nltk: < 3.10.0 (Fixed in: 3.10.0)

Code Analysis

Commit: 4a820af

Fixes SSRF vulnerability by implementing safe HTTP/HTTPS connections with socket-level IP pinning.

Exploit Details

  • NLTK Project Pull Request #3582: Contains regression tests illustrating the bypass of host validation using mock DNS servers and custom resolution pipelines.

Mitigation Strategies

  • Upgrade the NLTK library to version 3.10.0 or higher immediately.
  • Implement outbound firewall rules to prevent application servers from reaching private IP addresses.
  • Configure local DNS servers with anti-DNS-rebinding protection to drop responses mapping to loopback or RFC 1918 ranges.
  • Disable or restrict dynamic network-based resource loading within NLTK unless strictly required.

Remediation Steps:

  1. Identify all systems running Python workloads with the NLTK package installed.
  2. Execute 'pip install --upgrade nltk>=3.10.0' to update the library to the patched release.
  3. Verify the installed version using 'python -c "import nltk; print(nltk.version)"'.
  4. Apply outbound firewall blocks on target servers to restrict egress to the local metadata IP '169.254.169.254'.

References

Read the full report for CVE-2026-63311 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)