What is CVE-2026-12372?

CVE-2026-12372 is a low-severity vulnerability in Nltk Nltk/nltk, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.7/10. Published 2026-08-09.

How severe is CVE-2026-12372?

Low severity. CVSS v3 base score is 3.7 out of 10.

SSRF in Nltk Nltk/nltk

CVE-2026-12372

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fai…

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Nltk Nltk/nltk — versions unspecified

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

security@huntr.dev

Frequently asked questions

What is CVE-2026-12372?: CVE-2026-12372 is a low-severity vulnerability in Nltk Nltk/nltk, classified under Server-Side Request Forgery (SSRF). CVSS score: 3.7/10. Published 2026-08-09.
How severe is CVE-2026-12372?: Low severity. CVSS v3 base score is 3.7 out of 10.