CVE-2026-67201

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2
https://github.com/vlang/v/issues/27945
https://github.com/vlang/v/pull/27947
https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-net-urllib-and-net-http

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) V hasta 0.5.2, corregida en el commit 85859f0, contiene una vulnerabilidad de omisión de falsificación de petición del lado del servidor (SSRF) que permite a los atacantes eludir listas de permitidos basadas en host explotando una diferencia de analizador entre net.urllib y net.http. Los atacantes pueden crear una URL que contiene una barra invertida en la sección de autoridad de tal manera que net.urllib.parse() extrae el host de confianza para la validación de la lista de permitidos mientras que net.http.get() normaliza la barra invertida y se conecta al host interno, lo que permite el acceso a servicios de red internos que la lista de permitidos pretendía bloquear.

Information

Published : 2026-07-29 19:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-67201

Mitre link : CVE-2026-67201

CVE.ORG link : CVE-2026-67201

JSON object : View

Products Affected

No product.

CWE

CWE-436

Interpretation Conflict

{"id": "CVE-2026-67201", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67201", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T18:57:16.810884Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/vlang/v", "vendor": "vlang", "product": "v", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.5.2"}, {"status": "unaffected", "version": "85859f0f3498d4091b38009c45ed390a97eeedc2", "versionType": "git"}], "packageURL": "pkg:github/vlang/v", "defaultStatus": "affected"}]}], "published": "2026-07-29T19:16:51.330", "references": [{"url": "https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/vlang/v/issues/27945", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/vlang/v/pull/27947", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-net-urllib-and-net-http", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-436"}]}], "descriptions": [{"lang": "en", "value": "V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block."}, {"lang": "es", "value": "V hasta 0.5.2, corregida en el commit 85859f0, contiene una vulnerabilidad de omisi\u00f3n de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) que permite a los atacantes eludir listas de permitidos basadas en host explotando una diferencia de analizador entre net.urllib y net.http. Los atacantes pueden crear una URL que contiene una barra invertida en la secci\u00f3n de autoridad de tal manera que net.urllib.parse() extrae el host de confianza para la validaci\u00f3n de la lista de permitidos mientras que net.http.get() normaliza la barra invertida y se conecta al host interno, lo que permite el acceso a servicios de red internos que la lista de permitidos pretend\u00eda bloquear."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}