CVE catalog

CVE-2026-12372

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by re

[CVE catalog]

Severity
Low · CVSS 3.7CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.26% · Oct 25, 2026

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannltksid3.10.3-1vulnerable
Debiannltkforky3.10.3-1vulnerable
Debiannltktrixie3.9.1-2vulnerable
Debiannltkbookworm3.8-1vulnerable
CpenltkNot reportedNot reportedunknown
PyPInltkNot reported0.8vulnerable
PyPInltkNot reported0.9vulnerable
PyPInltkNot reported0.9.3vulnerable
PyPInltkNot reported0.9.4vulnerable
PyPInltkNot reported0.9.5vulnerable
PyPInltkNot reported0.9.6vulnerable
PyPInltkNot reported0.9.7vulnerable
PyPInltkNot reported0.9.8vulnerable
PyPInltkNot reported0.9.9vulnerable
PyPInltkNot reported2.0.1vulnerable
PyPInltkNot reported2.0.1rc1vulnerable
PyPInltkNot reported2.0.1rc2-gitvulnerable
PyPInltkNot reported2.0.1rc3vulnerable
PyPInltkNot reported2.0.1rc4vulnerable
PyPInltkNot reported2.0.2vulnerable
PyPInltkNot reported2.0.3vulnerable
PyPInltkNot reported2.0.4vulnerable
PyPInltkNot reported2.0.5vulnerable
PyPInltkNot reported2.0b4vulnerable
PyPInltkNot reported2.0b5vulnerable
PyPInltkNot reported2.0b6vulnerable
PyPInltkNot reported2.0b7vulnerable
PyPInltkNot reported2.0b8vulnerable
PyPInltkNot reported2.0b9vulnerable
PyPInltkNot reported3.0.0vulnerable
PyPInltkNot reported3.0.0b1vulnerable
PyPInltkNot reported3.0.0b2vulnerable
PyPInltkNot reported3.0.1vulnerable
PyPInltkNot reported3.0.2vulnerable
PyPInltkNot reported3.0.3vulnerable
PyPInltkNot reported3.0.4vulnerable
PyPInltkNot reported3.0.5vulnerable
PyPInltkNot reported3.1vulnerable
PyPInltkNot reported3.2vulnerable
PyPInltkNot reported3.2.1vulnerable
PyPInltkNot reported3.2.2vulnerable
PyPInltkNot reported3.2.3vulnerable
PyPInltkNot reported3.2.4vulnerable
PyPInltkNot reported3.2.5vulnerable
PyPInltkNot reported3.3vulnerable
PyPInltkNot reported3.4vulnerable
PyPInltkNot reported3.4.1vulnerable
PyPInltkNot reported3.4.2vulnerable
PyPInltkNot reported3.4.3vulnerable
PyPInltkNot reported3.4.4vulnerable
PyPInltkNot reported3.4.5vulnerable
PyPInltkNot reported3.5vulnerable
PyPInltkNot reported3.5b1vulnerable
PyPInltkNot reported3.6vulnerable
PyPInltkNot reported3.6.1vulnerable
PyPInltkNot reported3.6.2vulnerable
PyPInltkNot reported3.6.3vulnerable
PyPInltkNot reported3.6.4vulnerable
PyPInltkNot reported3.6.5vulnerable
PyPInltkNot reported3.6.6vulnerable
PyPInltkNot reported3.6.7vulnerable
PyPInltkNot reported3.7vulnerable
PyPInltkNot reported3.8vulnerable
PyPInltkNot reported3.8.1vulnerable
PyPInltkNot reported3.9vulnerable
PyPInltkNot reported3.9.1vulnerable
PyPInltkNot reported3.9.2vulnerable
PyPInltkNot reported3.9.3vulnerable
PyPInltkNot reported3.9.4vulnerable
PyPInltkNot reported3.9b1vulnerable
PipnltkNot reported3.10.0fixed
Opensusepython-nltktumbleweed3.10.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannltksourcesid(unfixed)not yet assignedNot reported[1144456]
Debiannltksourceforky(unfixed)not yet assignedNot reported[1144456]
Debiannltksourcetrixie(unfixed)not yet assignedNot reported[1144456]
Debiannltksourcebookworm(unfixed)not yet assignedNot reported[1144456]
PipnltkpipNot reported3.10.0Not reportedGHSA-2JHM-W3MP-JCWRNot reported
Opensusepython-nltkrpmtumbleweed3.10.2-1.1Not reportedOPENSUSE-SU-2026:11510-1Not reported

[Debian bug #1144456]

Notes

[trixie] nltk: Minor issue [bookworm] nltk: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-nltk]Affected

    Source package: [nltk]

    Details (2)

    • 3.8-1 · all · bookworm

      Affected

      nvd · nltk · debian · bookworm; nvd · nltk · debian · 12

    • 3.8-1 · all · bookworm

      Affected

      nvd · nltk · debian · bookworm; nvd · nltk · debian · 12

[Debian 13 (Trixie)]

  • [python3-nltk]Affected

    Source package: [nltk]

    Details (2)

    • 3.9.1-2 · all · trixie

      Affected

      nvd · nltk · debian · 13

    • 3.9.1-2 · all · trixie

      Affected

      nvd · nltk · debian · 13

[openSUSE Tumbleweed]

  • [python313-nltk]Unknown

    Source package: [python-nltk]

    Details (1)

    • 3.10.3-1.1 · noarch · tumbleweed

      Unknown · Fixed: 3.10.2-1.1

      Version impact unknown

      nvd · python-nltk · opensuse · tumbleweed

  • [python314-nltk]Unknown

    Source package: [python-nltk]

    Details (1)

    • 3.10.3-1.1 · noarch · tumbleweed

      Unknown · Fixed: 3.10.2-1.1

      Version impact unknown

      nvd · python-nltk · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]