CVE-2026-12372: Server-Side Request Forgery (SSRF) in nltk/nltk

Published Aug 9, 2026
·
Updated

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl() function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (100.64.0.0/10). This occurs because Python's ipaddress module does not classify such addresses as isprivate or isglobal, and the current guard only checks isprivate and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.

Affected Software

2 affected components
nltk/nltk=3.9.4
nltk/nltk

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade nltk/nltk to a version that resolves this vulnerability.

    Fixed in 3.9.4
  2. Compensating control

    If you use NLTK network-loading helpers with attacker-influenced URLs, restrict those helpers to only allow-listed external domains/URLs, and block access to RFC 6598 shared address space (100.64.0.0/10) from the application host (e.g., via egress firewall rules).

Event History

Aug 9, 2026
CVE Published
via MITRE·10:45 PM
Data Sourced
via MITRE·10:45 PM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-12372?

The severity of CVE-2026-12372 is rated as low, with a score of 3.7.

2

What type of vulnerability is represented by CVE-2026-12372?

CVE-2026-12372 represents a Server-Side Request Forgery (SSRF) vulnerability.

3

Which versions of nltk/nltk are affected by CVE-2026-12372?

CVE-2026-12372 affects nltk/nltk versions 3.9.4 and the current develop branch.

4

How can CVE-2026-12372 affect network security?

CVE-2026-12372 can potentially expose internal network addresses to unauthorized access due to the failure to reject certain IPs.

5

How do I fix CVE-2026-12372?

To fix CVE-2026-12372, update to a version of nltk/nltk that addresses this vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
CVE-2026-12372 - Server-Side Request Forgery (SSRF) in nltk/nltk - SecAlerts