CVE-2026-12372

{"id": "CVE-2026-12372", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12372", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T17:45:59.173613Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security@huntr.dev", "affectedData": [{"vendor": "nltk", "product": "nltk/nltk", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "latest"}]}]}], "published": "2026-08-09T23:16:35.793", "references": [{"url": "https://huntr.com/bounties/2911b643-571c-42e4-b0c2-9a1fa6f491db", "tags": ["Permissions Required"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/2911b643-571c-42e4-b0c2-9a1fa6f491db", "tags": ["Permissions Required"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed."}, {"lang": "es", "value": "Una vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) existe en las versiones 3.9.4 de nltk/nltk y en la rama de desarrollo actual. La funci\u00f3n \u2019nltk.pathsec.validate_network_url()\u2019, destinada a prevenir SSRF al rechazar direcciones de red internas, no logra rechazar IPs en el espacio de direcciones compartidas RFC 6598 (\u2019100.64.0.0/10\u2019). Esto ocurre porque el m\u00f3dulo \u2019ipaddress\u2019 de Python no clasifica dichas direcciones como \u2019is_private\u2019 o \u2019is_global\u2019, y la protecci\u00f3n actual solo verifica \u2019is_private\u2019 y algunas categor\u00edas expl\u00edcitas. Un atacante que puede influir en una URL pasada a las funciones de ayuda de carga de red de NLTK puede explotar esta vulnerabilidad para hacer que una aplicaci\u00f3n en modo estricto env\u00ede peticiones a hosts del espacio de direcciones compartidas, exponiendo potencialmente infraestructura no p\u00fablica accesible desde el host de la aplicaci\u00f3n. El impacto se limita a la exposici\u00f3n de confidencialidad de tipo SSRF, sin ejecuci\u00f3n de c\u00f3digo reclamada."}], "lastModified": "2026-10-23T20:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nltk:nltk:3.9.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E0F7C7D0-ADBA-409B-9E84-D8C569B4BFB2"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}