Executive brief
The Natural Language Toolkit (NLTK), a popular Python library for processing human language data, contains a security flaw in its internal web request functions. This vulnerability allows an attacker to bypass security filters designed to prevent the library from accessing sensitive internal network resources, such as private administrative interfaces or cloud credential services. If exploited, an attacker could steal sensitive data or gain unauthorized access to the underlying cloud infrastructure where the software is running.
Technical details
A DNS-rebinding vulnerability exists in `nltk.pathsec.urlopen` (affecting `nltk.download` and `nltk.data.load`) due to a Time-of-Check to Time-of-Use (TOCTOU) flaw in hostname resolution. The `validate_network_url()` function resolves a hostname to verify it is not a private or loopback IP, but the subsequent call to `urllib` performs a second, independent resolution at connection time. An attacker using a DNS record with a Time-to-Live (TTL) of zero can provide a safe IP during validation and a malicious internal IP during the actual connection. This bypasses the `ENFORCE` security mode, enabling non-blind SSRF against internal services or cloud metadata endpoints (e.g., IMDSv1). The issue is addressed in version 3.10.0.
Affected products
- NLTK Project nltk <= 3.9.4
Timeline
- 2026-06-11: disclosed
- 2026-07-31: advisory
- 2026-07-31: patched