Vulnerability Description
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2
- https://github.com/vlang/v/issues/27945
- https://github.com/vlang/v/pull/27947
- https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-ne
FAQ
What is CVE-2026-67201?
CVE-2026-67201 is a vulnerability with a CVSS score of 8.6 (HIGH). V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differenti...
How severe is CVE-2026-67201?
CVE-2026-67201 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-67201?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.