CVE-2026-12372

Received Received - Intake

SSRF in NLTK via RFC 6598 Shared Address Space

Publication date: 2026-08-09

Last updated on: 2026-08-09

Assigner: huntr.dev

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-09

Last Modified

2026-08-09

Generated

2026-08-10

AI Q&A

2026-08-10

EPSS Evaluated

N/A

NVD

CVE-2026-12372

EUVD

EUVD-2026-54961

Affected Vendors & Products

Vendor	Product	Version / Range
nltk	nltk	3.9.4
nltk	nltk	From 3.9.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the NLTK library versions 3.9.4 and the current develop branch. The issue is in the `nltk.pathsec.validate_network_url()` function, which is supposed to block internal network addresses to prevent SSRF attacks. However, it fails to block IP addresses in the RFC 6598 shared address space (100.64.0.0/10) because Python's `ipaddress` module does not classify these as private or global. An attacker could exploit this by providing a specially crafted URL to NLTK's network-loading functions, potentially accessing non-public infrastructure reachable from the application host.

The impact is limited to SSRF-style confidentiality exposure, meaning the attacker can make the application send requests to internal hosts but cannot execute arbitrary code.

Detection Guidance

This vulnerability is specific to the nltk library and cannot be detected via general network or system commands. Review applications using nltk 3.9.4 or the develop branch for URLs passed to network-loading helpers. Check if any requests are made to IP ranges like 100.64.0.0/10.

Impact Analysis

If you use NLTK versions 3.9.4 or the current develop branch in your application, an attacker could exploit this vulnerability to make your application send requests to internal network hosts. This could expose sensitive internal infrastructure or data if your application has access to such resources. The attacker would need to influence a URL passed to NLTK's network-loading helpers, which may be possible through user input or other indirect means.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing internal network resources or sensitive data through SSRF attacks. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. If an attacker can access internal hosts via this vulnerability, it may lead to unauthorized data exposure, violating these regulations.

Mitigation Strategies

Upgrade nltk to a patched version once available. If immediate upgrade is not possible, implement application-level validation to reject URLs with IPs in the 100.64.0.0/10 range. Review and restrict network access for applications using nltk.

Hi! I’m here to help you understand CVE-2026-12372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70