CVE-2026-12372 Overview
CVE-2026-12372 is a Server-Side Request Forgery (SSRF) vulnerability in the Natural Language Toolkit (NLTK) library, affecting version 3.9.4 and the current develop branch. The nltk.pathsec.validate_network_url() function fails to reject IP addresses in the RFC 6598 shared address space (100.64.0.0/10). Python's ipaddress module does not classify these addresses as is_private or is_global, and the guard only checks is_private and a small set of explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can force a strict-mode application to send requests to shared-address-space hosts. This vulnerability is classified under [CWE-918].
Critical Impact
An attacker can bypass NLTK's SSRF guard to reach non-public infrastructure in RFC 6598 shared address space, exposing carrier-grade NAT hosts reachable from the application server.
Affected Products
- NLTK 3.9.4
- NLTK current develop branch
- Applications relying on nltk.pathsec.validate_network_url() for SSRF protection
Discovery Timeline
- 2026-08-09 - CVE-2026-12372 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-12372
Vulnerability Analysis
The flaw sits in NLTK's SSRF prevention helper, nltk.pathsec.validate_network_url(). The function is designed to reject internal network destinations before NLTK performs an outbound HTTP request. It relies on Python's ipaddress module and inspects the is_private attribute along with a limited enumeration of explicit ranges.
RFC 6598 defines the 100.64.0.0/10 block as shared address space used by carrier-grade NAT deployments. Python's ipaddress module classifies these addresses as neither is_private nor is_global. Because the NLTK guard trusts is_private as the primary rejection criterion, addresses in 100.64.0.0/10 slip through validation.
The impact is confined to confidentiality exposure. An attacker cannot achieve code execution through this weakness. Exploitation requires an application to accept attacker-influenced URLs and pass them to NLTK network helpers under strict mode.
Root Cause
The root cause is an incomplete allowlist/denylist logic. validate_network_url() assumes that any non-is_private address is safe for outbound requests. It does not account for the shared address space defined in RFC 6598, nor for other categories such as 100.64.0.0/10 that Python's standard library marks as neither private nor globally routable.
Attack Vector
Exploitation is network-based and requires no authentication or user interaction, though attack complexity is high because the attacker must control a URL input consumed by NLTK's network-loading code path. A remote attacker submits a URL whose hostname resolves into 100.64.0.0/10. The strict-mode guard accepts the URL, and NLTK issues an HTTP request to the internal-adjacent host, returning response data or side-channel information to the attacker.
No verified public exploit code is available. Refer to the Huntr Bounty Report for the researcher's technical write-up.
Detection Methods for CVE-2026-12372
Indicators of Compromise
- Outbound HTTP or HTTPS connections from Python application hosts to destinations within 100.64.0.0/10.
- NLTK network helper invocations where the resolved destination falls outside expected public ranges.
- Application logs showing URL parameters with hostnames that resolve to shared address space.
Detection Strategies
- Instrument the application to log every URL passed to nltk.pathsec.validate_network_url() along with the resolved IP address.
- Deploy egress filtering rules that log or block requests destined for 100.64.0.0/10 from application subnets that should not reach carrier-grade NAT ranges.
- Correlate DNS resolution events with subsequent outbound requests to identify attacker-controlled hostnames pointing into shared address space.
Monitoring Recommendations
- Monitor for anomalous outbound traffic from Python workloads to 100.64.0.0/10 using network telemetry.
- Track NLTK version inventory across development and production environments to identify vulnerable installations.
- Alert on process-level network activity where the initiating binary is a Python interpreter running NLTK modules.
How to Mitigate CVE-2026-12372
Immediate Actions Required
- Audit application code paths that pass user-influenced URLs into NLTK network helpers and add an explicit denylist for 100.64.0.0/10.
- Enforce egress filtering at the network layer to block application hosts from reaching RFC 6598 shared address space.
- Track upstream NLTK releases and apply patched versions once available.
Patch Information
At the time of publication, no fixed NLTK version has been recorded in the NVD entry. Consult the Huntr Bounty Report for coordination status and monitor the NLTK develop branch for a corrective commit that adds 100.64.0.0/10 and other non-global, non-private ranges to the rejection logic.
Workarounds
- Wrap nltk.pathsec.validate_network_url() with an application-level check that resolves the hostname and rejects any address in 100.64.0.0/10, along with other reserved ranges such as 169.254.0.0/16 and 192.0.0.0/24.
- Restrict NLTK data downloads to a curated, hardcoded list of trusted URLs rather than accepting user input.
- Run NLTK-consuming workloads in a network segment with no route to internal infrastructure or shared address space.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
