Executive brief
NLTK is a widely-used natural language processing library that includes network URL validation to prevent server-side request forgery (SSRF) attacks. When DNS resolution fails (e.g., resolver unavailable or DNS rebinding), the validation function silently passes instead of rejecting the request, allowing attackers to access restricted endpoints like cloud metadata services that expose credentials and authentication tokens. This bypass is particularly dangerous in cloud environments where metadata endpoints contain sensitive AWS or GCP credentials.
Technical details
The vulnerability is a fail-open SSRF bypass in NLTK's newly-added pathsec.py security module. The validate_network_url() function calls _resolve_hostname() to resolve a domain and validate its IP against a blocklist. However, when socket.getaddrinfo() raises OSError or ValueError (e.g., DNS server unavailable, invalid hostname), _resolve_hostname() catches the exception and returns an empty list []. The validation loop in validate_network_url() then iterates over this empty list (for addr in resolved: ... executes zero times) with no else clause or fallback check. The function returns normally without raising an exception, allowing urlopen() to proceed without any IP validation. Attackers can exploit this by: (1) inducing temporary DNS failures to disable all SSRF protections; (2) using DNS rebinding to bypass the LRU cache after expiration; (3) targeting environments with unreliable resolvers. No authentication or user interaction is required; the vulnerability exists network-accessible via any URL passed to the affected code path. Patch is available in NLTK 3.10.0, which adds explicit validation to reject URLs when DNS resolution fails rather than returning normally.
Affected products
- NLTK Project NLTK <= 3.9.4
Timeline
- 2026-08-07: disclosed: Initial disclosure on GitHub Advisory Database
- 2026-09-02: advisory: Advisory published to GitHub Advisory Database
- 2026-09-02: patched: Fix released in NLTK 3.10.0