annotald (1.3.8), caterpillar (>=1.0.0.dev4, <=1.0.0.dev17) potentially affected by CVE-2026-63311 via nltk (2.0.5)

nltk PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald 1.3.8 - caterpillar =1.0.0.dev4, =1.0.0.dev17 Source cves: CVE-2026-63311 Source advisory: OSV:GHSA-3GQM-FCW5-W839...

DEBIAN-CVE-2026-63311

NLTK before 3.10.0 affected versions = 3.9.4 contains a server-side request forgery SSRF vulnerability in the validatenetworkurl function in nltk/pathsec.py. The resolvehostname helper catches OSError and ValueError during socket.getaddrinfo and returns an empty list; when DNS resolution fails, t...

EUVD-2026-63311

Subscriber Remote Code Execution RCE in Query Wrangler = 1.5.57 versions...