CVE-2026-12075

Name of the Vulnerable Software and Affected Versions NLTK (affected versions not specified)

Description An SSRF filter in nltk.pathsec is bypassable via DNS rebinding. The validate network url() function resolves a hostname to check if the IP is within blocked ranges (loopback, private, link-local, or multicast), but the subsequent HTTP connection via urlopen() performs a second, independent name resolution. An attacker can use a DNS record with a TTL of 0 to return a public IP during validation and an internal IP during the actual connection. This allows unauthorized access to internal HTTP services, loopback admin interfaces, and cloud instance metadata services, potentially exposing sensitive credentials. The issue persists even when nltk.pathsec.ENFORCE is set to True. The resolve hostname() function uses lru cache, but this only affects the validation phase and does not protect the connection phase.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.