NLTK's pathsec module includes an SSRF filter intended to block access to loopback, private, link-local, and multicast IP ranges. However, this filter can be bypassed via DNS rebinding, where the hostname resolves to a public IP during validation but resolves to an internal or loopback IP at connection time. This bypass defeats the strict ENFORCE mode, allowing unauthorized access to internal services. The vulnerability is identified as CVE-2026-12075 and has a high severity score of 8.6. A patch is available to address this issue.