Server-side Request Forgery (SSRF) Affecting nltk package, versions [,3.10.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-NLTK-18507677
- published2 Aug 2026
- disclosed31 Jul 2026
- creditUnknown
Introduced: 31 Jul 2026
NewCVE-2026-12075 (opens in a new tab)How to fix?
Upgrade nltk to version 3.10.0 or higher.
Overview
nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through the urlopen process in nltk.pathsec. An attacker can reach loopback or internal HTTP services by supplying a hostname that resolves to a public IP during SSRF validation and to a private IP when urllib makes the actual connection. This defeats nltk.pathsec.ENFORCE and lets nltk.download(server_index_url=...) or nltk.data.load("http://...") fetch and return content from services that the filter was meant to block, including internal admin endpoints and metadata services.