CVE-2026-12372: nltk Server-Side Request Forgery (SSRF)

Vulnerability summary

CVE-2026-12372 is a low (CVSS 3.7) Server-Side Request Forgery (SSRF) vulnerability in nltk. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.5% of scored vulnerabilities.

Timeline

1. 09-08-2026
   PublishedVulnerability first disclosed.
2. 12-08-2026
   Last modifiedVulnerability information updated.

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.

• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.