PatchTheCVECVE-2026-12372: A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop
22
Routine
LOW 3.7REMOTEDOWNGRADE
CVE-2026-12372 is a low-severity flaw (CVSS 3.7) affecting nltk. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard onl
Why this priority
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 3.7 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 83%) |
| CISA exploited list | No |
| Weakness | CWE-918 |
| Published | 2026-08-09 |
| Last modified | 2026-10-23 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
nltk nltk DOWNGRADE
Affected: 3.9.4
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.9.4
1. Check installed version
apt-cache policy nltk || rpm -q nltk || nltk --version
2. No fixed release: DOWNGRADE to a release before 3.9.4 (Debian / Ubuntu)
apt-cache madison nltk
sudo apt install nltk=<VERSION_BEFORE_3.9.4>
sudo apt-mark hold nltk
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list nltk
sudo dnf downgrade nltk-<VERSION_BEFORE_3.9.4>
sudo dnf versionlock add nltk
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-12259 MEDIUM 6.5 DOWNGRADE In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package
- CVE-2026-12261 MEDIUM 6.5 UPGRADE A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and mode