Vulnerability · Published Jul 29, 2026 · Assigned by VulnCheck

CVE-2026-67201V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

High 8.6

In plain English

A high-severity security flaw in v from vlang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.5%top 54.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.

Affected products (as reported)

Vendor	Product	Versions
vlang	v	0 – through 0.5.2

Weakness: CWE-436 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Researcher Disclosure technical-description, exploit
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-net-urllib-and-net-http third-party-advisory