CVE-2026-63311: NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution Failure

There is an SSRF vulnerability in NLTK 3.9.4’s network URL validation. The validate_network_url() function in nltk/pathsec.py fails open when DNS resolution returns an error.

The _resolve_hostname() helper at lines 193-234 catches OSError and ValueError during socket.getaddrinfo() and returns an empty list []. When this happens, the validation loop in validate_network_url() iterates over nothing (for addr in resolved: … never executes), with no else/fallback check. The function returns normally, and urlopen() proceeds to make the request without any IP validation.

This means:

1. If DNS is temporarily unavailable, ALL SSRF protections are disabled
2. DNS rebinding attacks bypass the check after the LRU cache entry expires
3. In environments with unreliable resolvers, the protection is permanently bypassed

PoC:

import nltk.pathsec
import unittest.mock