Threats Tagged 'cve-2026-12372'

The python313-nltk-3.10.2-1.1 package on openSUSE Tumbleweed addresses multiple security issues, including CVE-2026-12372. This vulnerability is categorized under CWE-918 and has a medium severity rating. The affected versions include exactly version 3.9.4 and some unspecified versions related to SUSE architectures such as aarch64 and ppc64le. No explicit patch links or vendor advisory details are provided, and no known exploits in the wild have been reported.

A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed.