PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-12372 nltk CVE debrief

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed. Developers and administrators using nltk/nltk versions 3.9.4 and the current develop branch should be aware of this vulnerability and take steps to address it to prevent potential confidentiality exposure. Limited evidence is available, and further verification is needed to fully understand the vulnerability's impact. The CVE record was published on 2026-08-09T23:16:35.793Z and has not been modified since then.

Vendor
nltk
Product
nltk/nltk
CVSS
LOW 3.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-09
Original CVE updated
2026-08-09
Advisory published
2026-08-09
Advisory updated
2026-08-09

Who should care

Developers and administrators using nltk/nltk versions 3.9.4 and the current develop branch should be aware of this vulnerability and take steps to address it to prevent potential confidentiality exposure.

Technical summary

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories.

Defensive priority

This vulnerability has a low CVSS score of 3.7, indicating a relatively low severity. However, it is still important to address the Server-Side Request Forgery (SSRF) vulnerability in nltk/nltk versions 3.9.4 and the current develop branch to prevent potential confidentiality exposure.

Recommended defensive actions

  • Review and update the `nltk.pathsec.validate_network_url()` function to properly reject IPs in the RFC 6598 shared address space.
  • Implement additional security measures to prevent SSRF-style confidentiality exposure.
  • Monitor and track changes to the nltk/nltk library to ensure timely updates and patches.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists in the `nltk.pathsec.validate_network_url()` function, which fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. Limited evidence is available, and further verification is needed to fully understand the vulnerability's impact.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-09T23:16:35.793Z and has not been modified since then.