The SSRF vulnerability in nltk (CVE-2026-12372) is due to the `nltk.pathsec.validate_network_url()` function failing to reject IP addresses in the RFC 6598 shared address space (100.64.0.0/10). This occurs because Python's `ipaddress` module does not classify these addresses as private or global, and the validation only checks for private IPs and some explicit categories. Consequently, an attacker able to influence URLs passed to NLTK's network-loading helpers can exploit this to make the application send requests to internal shared-address-space hosts, potentially exposing non-public infrastructure accessible from the host. The vulnerability affects nltk version 3.9.4 and the current develop branch. The CVSS 3.0 base score is 3.7, indicating low severity, with impact limited to confidentiality loss. There is no known code execution or availability impact. No patch or official fix information is provided in the data.

The vulnerability allows an attacker to perform SSRF attacks that can expose internal or shared-address-space infrastructure reachable from the application host. The impact is limited to confidentiality exposure; there is no indication of code execution, integrity, or availability impact. The CVSS score of 3.7 reflects a low severity confidentiality impact with high attack complexity and no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid passing untrusted URLs to NLTK's network-loading helpers or implement additional validation to block RFC 6598 shared address space IPs. Monitor vendor channels for updates or official patches addressing this SSRF vulnerability.