Fluid Attacks Database

Description

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	nltk	=3.9.1-2 \|\| =3.9.2-1 \|\| >=0 <3.9.3-1	3.9.3-1
debian 11	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.5-1 \|\| =3.6.5-1 \|\| =3.6.7-1 \|\| =3.7-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 13	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-
debian 12	nltk	=3.10.0-1 \|\| =3.10.1-1 \|\| =3.10.3-1 \|\| =3.8-1 \|\| =3.8.1-1 \|\| =3.9.1-1 \|\| =3.9.1-2 \|\| =3.9.2-1 \|\| =3.9.3-1	-

Aliases

1. CVE-2026-633102. NVD-2026-633103. OSV-DEBIAN-2026-633104. OSV-2026-633105. SECURITY-TRACKER-CVE-2026-63310

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.