High [CVE-2026-63310] NLTK before 3.9.3 Missing Post-Download Integrity Verification
This high-severity Red Hat Linux advisory covers CVE-2026-63310 affecting Red Hat Ansible Automation Platform 2.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.
Red Hat has rated this issue as having an Impact of Important. This flaw is only exploitable when application code calls NLTK's downloader module (e.g. nltk.download()) to fetch corpora or model packages from the network at runtime, and an attacker is able to intercept or redirect that traffic via a man-in-the-middle position or DNS poisoning.
Red Hat products that vendor nltk but do not invoke the downloader at runtime -- for example, images that ship pre-bundled NLTK data baked in at build time -- are not affected by this flaw regardless of the packaged nltk version. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).
Weakness: CWE-494. Affected Red Hat products: Red Hat Ansible Automation Platform 2.
Under investigation: Exploit Intelligence; Red Hat OpenShift AI (RHOAI). Red Hat lists Lightspeed Core; OpenShift Lightspeed; Red Hat OpenShift AI (RHOAI) as not affected.
Red Hat does not currently list a fixing RHSA for this CVE.
- < 3.9.3
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation checklist
- Upgrade the nltk package to version 3.9.3 or later, which adds post-download integrity verification before extraction. Pin this minimum version in requirements files, lockfiles, and container image builds for all affected components. Where an immediate upgrade is not possible: avoid invoking NLTK's automatic downloader over untrusted or unauthenticated networks. Pre-download and independently verify the required NLTK data packages from a trusted source, host them in an internal, integrity-checked artifact repository, and point NLTK_DATA at that vetted local store so the runtime process never fetches data over the wire. Enforcing TLS with certificate validation and using trusted, DNSSEC-validated resolvers for the download endpoint reduces exposure to MITM/DNS-poisoning attacks but does not substitute for upgrading, since the underlying missing-integrity-check flaw remains present.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.