---
id: CVE-2026-67201
title: V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http
summary: >-
  V through 0.5.2, fixed in commit 85859f0, contains a server-side request
  forgery (SSRF) bypass vulnerability that allows attackers to circumvent
  host-based allowlists by exploiting a parser differential between net.urllib
  and net.http. A…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-436
vendor: vlang
product: v
affected:
  - v <= 0.5.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-07-29T18:57:16.810884Z'
exploitAvailable: true
published: '2026-07-29'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:08:08.270Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-67201'
references:
  - url: 'https://github.com/vlang/v/issues/27945'
    label: Researcher Disclosure
  - url: 'https://github.com/vlang/v/pull/27947'
    label: Pull Request
  - url: 'https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2'
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-net-urllib-and-net-http
tags:
  - cve.org
  - exploit-available
epss: 0.00534
epssPercentile: 0.45325
ingestedAt: '2026-11-08T14:51:22.267Z'
---

## Overview

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.

## Affected

- `v <= 0.5.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.