CVE-2026-12372

Name of the Vulnerable Software and Affected Versions nltk/nltk version 3.9.4 nltk/nltk develop branch

Description A Server-Side Request Forgery (SSRF) issue exists where the nltk.pathsec.validate network url() function fails to reject IP addresses within the RFC 6598 shared address space (100.64.0.0/10). This happens because the Python ipaddress module does not categorize these addresses as is private or is global, and the validation logic only checks for is private and a limited set of categories. An attacker capable of influencing a URL passed to network-loading helpers can force a strict-mode application to send requests to hosts in the shared address space, potentially exposing non-public infrastructure. The impact is limited to confidentiality exposure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.