CVE-2026-63310: NLTK before 3.9.3 Missing Post-Download Integrity Verification
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Affected Software
Event History
Frequently Asked Questions
Which NLTK installations are affected?
NLTK versions before 3.9.3 are affected when they download packages through the downloader module. The issue applies to package downloads that are subsequently extracted without post-download integrity verification.
What does an attacker need to exploit this?
An attacker must be able to interfere with the package download path, such as through a man-in-the-middle attack or DNS poisoning. Exploitation also requires a user or process to download and extract the attacker-influenced package content.
Is user interaction required?
Yes. The supplied CVSS vector indicates user interaction is required, and the described attack relies on a package download being performed before the malicious contents are extracted.
What is the remediation?
Upgrade NLTK to version 3.9.3 or later. This version boundary is the only remediation information provided.