A server‑side request forgery vulnerability is present in the network‑loading helper of the nltk library. The validate_network_url function, designed to prevent internal network requests, fails to reject IP addresses in the RFC 6598 shared address space (100.64.0.0/10). An attacker who can supply a URL that bypasses the helper can force the application to issue outbound requests to hosts in the shared‑address range, potentially leaking information about internal infrastructure. No code execution or privilege escalation is claimed; the impact is limited to confidentiality exposure through SSRF.

The vulnerability affects all installations of the nltk library built from source when the validate_network_url function is invoked. Specifically, versions 3.9.4 and the current development branch are impacted. The flaw lies in the library’s internal validation logic, which is vendor‑specific to nltk/nltk.

The CVSS score of 3.7 indicates a low‑to‑moderate severity. EPSS data is unavailable and the issue is not listed in KEV, so widespread exploitation is not currently documented. The likely attack vector requires the attacker to influence a URL that is passed to nltk’s network‑loading helpers, a scenario that would arise in applications that fetch resources based on user input. No authentication or privilege escalation is required, but the exposure of internal hosts could facilitate further attacks such as credential harvesting or pivoting within the network.