{"vulnerability": "CVE-2026-6331", "sightings": [{"uuid": "9d5c12c3-05e4-4a40-ad5e-0fc226ee2489", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6331", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp5gdqrqws2u", "content": "CVE-2026-6331 - HMAC zero-length tag forgery in EVP_DigestVerifyFinal\nCVE ID : CVE-2026-6331\n \n Published : June 25, 2026, 8:56 p.m. | 48\u00a0minutes ago\n \n Description : HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid duri...", "creation_timestamp": "2026-06-25T21:57:19.382166Z"}, {"uuid": "7037ccaa-23a4-4f8f-8e70-ba01d391a11d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63310", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtomcl6cs52p", "content": "CVE-2026-63310 - nltk\nIf you use the Natural Language Toolkit (NLTK) version earlier than 3.9.3, the software does not check that downloaded language data files are genuine before unpacking them. This means an attacker\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nltk #CVE #infosec", "creation_timestamp": "2026-08-22T15:40:04.572945Z"}, {"uuid": "7df68f8e-c61d-4600-afe2-5bd52a824acb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63310", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtont55gq22e", "content": "\ud83d\udea8 CVE-2026-63310 \u2014 CVSS 9.3 CRITICAL\n\nNLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the do...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-63310\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-22T16:07:13.792283Z"}, {"uuid": "89007c0f-6a27-4774-b490-064b49557ebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63312", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtp67lynrr2r", "content": "\ud83d\udfe0 CVE-2026-63312 - High (7.5)\n\nNLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63312/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T21:00:32.637085Z"}, {"uuid": "e6e140cd-4961-49cf-8068-1139bac6515e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63310", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117142940889855260", "content": "CVE-2026-63310: NLTK <3.9.3 has a CRITICAL flaw where package integrity isn't checked post-download in the downloader module. Exposes users to MITM & DNS poisoning attacks. Upgrade to 3.9.3+ or avoid insecure networks. https://radar.offseq.com/threat/nltk-before-393-fails-to-verify-file-integrity-after-downloading-packages-and-before-extraction-in-the-f6492d4a6dda17c2 #OffSeq #NLTK #CVE202663310 #infosec", "creation_timestamp": "2026-08-23T04:30:27.123274Z"}, {"uuid": "5a99530f-2f4b-4d5f-962c-0617f3f5e7bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63310", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtpyz2zwvq2t", "content": "CVE-2026-63310\nIf you use the Natural Language Toolkit version earlier than 3.9.3, the tool does not check that downloaded language data files are genuine before unpacking them. This means an attacker who can intercept or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-23T05:00:04.358574Z"}, {"uuid": "4fd30170-1f1c-4df3-9e71-44aae1374690", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63313", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mrdwycxfmx2a", "content": "\ud83d\udfe0 CVE-2026-63313 - High (7.7)\n\n9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63313/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-23T23:01:31.933765Z"}, {"uuid": "c1e493d8-eb4d-40cf-b8a8-2bd53e5a0e60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63317", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mrffhds5hm2d", "content": "CVE-2026-63317: Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML", "creation_timestamp": "2026-07-24T12:53:07.299623Z"}, {"uuid": "82e9c7d9-3333-4143-8ccc-a9a00986eb96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63310", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mtt634mhzm2o", "content": "CVE-2026-63310 - MITM package injection flaw in NLTK downloader module. CVSS 7.1. Update NLTK to 3.9.3+ immediately. #CVE #Python #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-63310/", "creation_timestamp": "2026-08-24T11:08:40.751229Z"}, {"uuid": "f8e2068f-787a-4b27-a885-07df027c5e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63310", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117150169219152410", "content": "CVE-2026-63310 - MITM package injection flaw in NLTK downloader module. CVSS 7.1. Update NLTK to 3.9.3+ immediately. #CVE #Python #infosec\nhttps://www.valtersit.com/cve/CVE-2026-63310/", "creation_timestamp": "2026-08-24T11:08:41.903378Z"}, {"uuid": "7ef12808-66b0-4f41-bdef-c9d597cf9ce5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63312", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117150416497083462", "content": "CVE-2026-63312 - Arbitrary local file read in NLTK StreamBackedCorpusView bypasses pathsec. CVSS 7.5. Exposes sensitive system files. Update to NLTK 3.10.0+. #CVE #Python #infosec\nhttps://www.valtersit.com/cve/CVE-2026-63312/", "creation_timestamp": "2026-08-24T12:11:36.882791Z"}, {"uuid": "5a1772d3-c1ad-45ab-b977-ee809e1e2130", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63311", "type": "published-proof-of-concept", "source": "https://github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839", "content": "", "creation_timestamp": "2026-09-02T16:35:05.215429Z"}, {"uuid": "b01c4778-5c86-4ddc-906c-91a24d34f756", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63311", "type": "seen", "source": "https://gist.github.com/alon710/d2b8511d121d9c8c1d87b14251d4a3da", "content": "# CVE-2026-63311: CVE-2026-63311: Server-Side Request Forgery and DNS Rebinding in Natural Language Toolkit (NLTK)\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63311\n\n## Summary\nA vulnerability in the Natural Language Toolkit (NLTK) before version 3.10.0 allowed attackers to bypass SSRF filters via DNS resolution failures and DNS rebinding. By exploiting these weaknesses, unauthenticated remote attackers could coerce hosting systems into scanning internal networks or accessing sensitive cloud metadata endpoints.\n\n## TL;DR\nNLTK versions prior to 3.10.0 are vulnerable to Server-Side Request Forgery (SSRF) and DNS rebinding. Due to fail-open exception handling in DNS resolution and a lack of IP pinning, security checks on remote URLs can be completely bypassed by attackers controlling the target server or domain.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9\n- **EPSS Score**: 0.00241\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- Python environments utilizing the nltk library\n- **nltk**: < 3.10.0 (Fixed in: `3.10.0`)\n\n## Mitigation\n\n- Upgrade the NLTK library to version 3.10.0 or higher immediately.\n- Implement outbound firewall rules to prevent application servers from reaching private IP addresses.\n- Configure local DNS servers with anti-DNS-rebinding protection to drop responses mapping to loopback or RFC 1918 ranges.\n- Disable or restrict dynamic network-based resource loading within NLTK unless strictly required.\n\n**Remediation Steps:**\n1. Identify all systems running Python workloads with the NLTK package installed.\n2. Execute 'pip install --upgrade nltk>=3.10.0' to update the library to the patched release.\n3. Verify the installed version using 'python -c \"import nltk; print(nltk.__version__)\"'.\n4. Apply outbound firewall blocks on target servers to restrict egress to the local metadata IP '169.254.169.254'.\n\n## References\n\n- [GitHub Security Advisory GHSA-3gqm-fcw5-w839](https://github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839)\n- [NVD Vulnerability Page for CVE-2026-63311](https://nvd.nist.gov/vuln/detail/CVE-2026-63311)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/nltk-before-ssrf-via-dns-resolution-failure)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63311) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T21:32:05.530622Z"}, {"uuid": "33132d10-1967-4ba4-8394-587ffb3f2f44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63312", "type": "published-proof-of-concept", "source": "https://github.com/nltk/nltk/security/advisories/GHSA-x5ph-mj9p-rfr8", "content": "", "creation_timestamp": "2026-09-08T16:35:10.174147Z"}]}