CVE-2026-67201
V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.
| CWE | CWE-436 |
| Vendor | vlang |
| Product | v |
| Published | Jul 29, 2026 |
| Last Updated | Jul 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for vlang v
Be the first to know when new high vulnerabilities affecting vlang v are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
vlang / v
0 ≤ 0.5.2
References
github.com: https://github.com/vlang/v/issues/27945 github.com: https://github.com/vlang/v/pull/27947 github.com: https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2 vulncheck.com: https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-net-urllib-and-net-http
Credits
Ziad Salah