{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"nltk","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQEB3RT9AXXZDKYPCFFWVA","modified_at":"2026-10-24T09:47:33.140596113Z","published_at":"2026-08-09T23:16:35.793Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-12372","https://security-tracker.debian.org/tracker/CVE-2026-12372"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-12372#Debian:14/nltk","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-12372"}],"summary":"A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by re"}