CVE-2026-12372

NLTK's URL validator allows SSRF attacks via the shared address space.

• CVSS 3.7
• 918
• Input Validation and Sanitization
• Remote

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.

CVE

CVE-2026-12372

CWE

918

CVSS base score

3.7

Published

2026-08-09

OWASP

A10 Server-Side Request Forgery

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Server-Side Request Forgery (SSRF)

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

nltk

Fixed by upgrading

Yes

Solution

No stable patched version is currently available. To apply the fix, install the latest development version from the main branch: `pip install git+https://github.com/nltk/nltk.git`

import ipaddress
from urllib.parse import urlparse

class SecurityException(ValueError):
    pass

def validate_network_url(url: str):
    """
    Validate a URL to ensure it does not point to a local or private network address.
    This function only checks IP address literals in the hostname.
    """
    try:
        hostname = urlparse(url).hostname
        if not hostname:
            raise SecurityException(f"URL has no hostname: {url!r}")

        addr = ipaddress.ip_address(hostname)
    except ValueError:
        # It's a domain name, not an IP literal. A robust checker should
        # resolve it, but for this example, we assume it's safe.
        return

    # VULNERABLE: Does not check for RFC 6598 shared address space.
    if addr.is_private or addr.is_loopback or addr.is_link_local:
        raise SecurityException(
            f"Access to internal network resource {hostname} is forbidden."
        )

import ipaddress
from urllib.parse import urlparse

class SecurityException(ValueError):
    pass

def validate_network_url(url: str):
    """
    Validate a URL to ensure it does not point to a local or private network address.
    This function only checks IP address literals in the hostname.
    """
    try:
        hostname = urlparse(url).hostname
        if not hostname:
            raise SecurityException(f"URL has no hostname: {url!r}")

        addr = ipaddress.ip_address(hostname)
    except ValueError:
        # It's a domain name, not an IP literal. A robust checker should
        # resolve it, but for this example, we assume it's safe.
        return

    # FIX: Explicitly checks for RFC 6598 shared address space.
    if (
        addr.is_private
        or addr.is_loopback
        or addr.is_link_local
        or addr in ipaddress.ip_network("100.64.0.0/10")
    ):
        raise SecurityException(
            f"Access to internal network resource {hostname} is forbidden."
        )

http://100.64.0.1/internal-api

@misc{vaitp:cve202612372,
  title        = {{NLTK's URL validator allows SSRF attacks via the shared address space.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-12372},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-12372/}}
}