Gptline: NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure (CVE-2026-63311)

The SSRF vulnerability in NLTK 3.9.4 occurs in the validate_network_url() function within nltk/pathsec.py. When DNS resolution via _resolve_hostname() fails due to OSError or ValueError, it returns an empty list. The validation loop then does not execute, and the function returns normally without validating the IP address. This fail-open behavior disables SSRF protections if DNS is unavailable or unreliable, enabling attackers to bypass checks and potentially access sensitive internal resources such as cloud metadata services. The correct behavior is to fail-closed by rejecting URLs when DNS resolution fails. A patch is available to add an explicit check that raises a SecurityError if hostname resolution returns empty.

The vulnerability allows attackers to bypass SSRF protections when DNS resolution fails, potentially enabling unauthorized access to internal or cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254). This can lead to disclosure of sensitive credentials or service account tokens, resulting in high confidentiality impact on downstream systems. The issue affects environments with unreliable DNS resolvers or during temporary DNS outages, increasing the risk of exploitation.

A patch is available for this vulnerability. The vendor recommends applying the fix that enforces fail-closed behavior by raising an exception when DNS resolution fails during URL validation. This prevents requests from proceeding without proper IP validation. Users should update to the fixed version of NLTK to mitigate this SSRF vulnerability.