THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-3gqm-fcw5-w839 (medium) — NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

[GHSA] GHSA-3gqm-fcw5-w839 (medium) — NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

highgithub_advisoriesPublished 2026-09-02

GHSA-3gqm-fcw5-w839 Severity: medium CVE: CVE-2026-63311

NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

There is an SSRF vulnerability in NLTK 3.9.4's network URL validation. The validate_network_url() function in nltk/pathsec.py fails open when DNS resolution returns an error.

The _resolve_hostname() helper at lines 193-234 catches OSError and ValueError during socke

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-63311cve
CVE-2024-39705cve
CVE-2026-33236cve
http://169.254.169.254/latest/meta-data/url

Original source: https://github.com/advisories/GHSA-3gqm-fcw5-w839