CVE-2026-12372

{
  "id": "CVE-2026-12372",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-09T23:16:35.793",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) existe en las versiones 3.9.4 de nltk/nltk y en la rama de desarrollo actual. La función ’nltk.pathsec.validate_network_url()’, destinada a prevenir SSRF al rechazar direcciones de red internas, no logra rechazar IPs en el espacio de direcciones compartidas RFC 6598 (’100.64.0.0/10’). Esto ocurre porque el módulo ’ipaddress’ de Python no clasifica dichas direcciones como ’is_private’ o ’is_global’, y la protección actual solo verifica ’is_private’ y algunas categorías explícitas. Un atacante que puede influir en una URL pasada a las funciones de ayuda de carga de red de NLTK puede explotar esta vulnerabilidad para hacer que una aplicación en modo estricto envíe peticiones a hosts del espacio de direcciones compartidas, exponiendo potencialmente infraestructura no pública accesible desde el host de la aplicación. El impacto se limita a la exposición de confidencialidad de tipo SSRF, sin ejecución de código reclamada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nltk",
          "product": "nltk/nltk",
          "versions": [
            {
              "version": "unspecified",
              "lessThanOrEqual": "latest",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T17:45:59.173613Z",
          "id": "CVE-2026-12372",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:nltk:nltk:3.9.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0F7C7D0-ADBA-409B-9E84-D8C569B4BFB2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://huntr.com/bounties/2911b643-571c-42e4-b0c2-9a1fa6f491db",
      "source": "[email protected]",
      "tags": [
        "Permissions Required"
      ]
    },
    {
      "url": "https://huntr.com/bounties/2911b643-571c-42e4-b0c2-9a1fa6f491db",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Permissions Required"
      ]
    }
  ]
}