CVE-2026-12372
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.
- Affected products
- Nltk
- CVSS 3.0
- 3.7 LOW
- EPSS
- 0.3% (18th percentile)
- Weakness
- CWE-918
- NVD status
- Received
- Published
- 2026-08-09
No indexed exploits for CVE-2026-12372 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-12372 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.