Server-Side Request Forgery (SSRF) in Natural Language Toolkit - #VU141250
Published: August 7, 2026
Vulnerability identifier: #VU141250
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper control of outbound network requests in validate_network_url() in nltk/pathsec.py when handling URLs whose hostname resolution fails. A remote attacker can supply a crafted URL to perform server-side request forgery.
The issue is caused by a fail-open condition when DNS resolution returns an error and _resolve_hostname() returns an empty list, which can also enable bypass after DNS rebinding once the cache entry expires.
Affected software
Natural Language Toolkit
Remediation
Install security update from vendor's website.
Natural Language Toolkit - update to 3.10.0