{"id":"CVE-2026-67201","summary":"V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http","details":"V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.","modified":"2026-07-31T03:49:08.854056687Z","published":"2026-07-29T18:12:34.162Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-436"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67201.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67201.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67201"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/v-ssrf-bypass-via-parser-differential-in-net-urllib-and-net-http"},{"type":"REPORT","url":"https://github.com/vlang/v/pull/27947"},{"type":"FIX","url":"https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2"},{"type":"PACKAGE","url":"https://github.com/vlang/v"},{"type":"EVIDENCE","url":"https://github.com/vlang/v/issues/27945"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vlang/v","events":[{"introduced":"0"},{"fixed":"7647ce1c6fad63b5578bc07883139906de74b2f8"},{"fixed":"85859f0f3498d4091b38009c45ed390a97eeedc2"}],"database_specific":{"source":["DESCRIPTION","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.5.2"}]}}],"versions":["0.5.2","0.5.1","weekly.2026.08","weekly.2026.07","weekly.2026.06","weekly.2026.05","weekly.2026.04","weekly.2026.03","weekly.2026.02","0.5","weekly.2025.01","weekly.2025.52","weekly.2025.51","weekly.2025.50","weekly.2025.49","weekly.2025.48","weekly.2025.47","weekly.2025.46","weekly.2025.45","weekly.2025.44","weekly.2025.43","weekly.2025.42","weekly.2025.41","weekly.2025.40","weekly.2025.39","0.4.12","weekly.2025.38","weekly.2025.37","weekly.2025.36","weekly.2025.35","weekly.2025.34","weekly.2025.33","weekly.2025.32","weekly.2025.31","weekly.2025.30","weekly.2025.29","weekly.2025.28","weekly.2025.27","weekly.2025.26","0.4.11","weekly.2025.25","weekly.2025.24","weekly.2025.23","weekly.2025.22","weekly.2025.21","weekly.2025.20","weekly.2025.19","weekly.2025.18","weekly.2025.17","weekly.2025.16","weekly.2025.14","weekly.2025.13","0.4.10","weekly.2025.12","weekly.2025.11","weekly.2025.10","weekly.2025.09","weekly.2025.08","weekly.2025.07","weekly.2025.06","weekly.2025.05","weekly.2025.04","weekly.2025.03","weekly.2025.1","weekly.2024.53","weekly.2024.52","0.4.9","weekly.2024.51","weekly.2024.50","weekly.2024.49","weekly.2024.48","weekly.2024.47","weekly.2024.46","weekly.2024.45","weekly.2024.44","weekly.2024.43","weekly.2024.42","weekly.2024.41","0.4.8","weekly.2024.39","weekly.2024.37","weekly.2024.36","weekly.2024.35","weekly.2024.34","weekly.2024.33","weekly.2024.32","weekly.2024.31","0.4.7","weekly.2024.30","weekly.2024.29","weekly.2024.28","weekly.2024.27","weekly.2024.26","weekly.2024.25","weekly.2024.24","weekly.2024.23","weekly.2024.22","0.4.6","weekly.2024.20","weekly.2024.19","weekly.2024.18.2","weekly.2024.18","weekly.2024.17","weekly.2024.16.1","weekly.2024.16","weekly.2024.14","weekly.2024.13","0.4.5","weekly.2024.12","weekly.2024.11","weekly.2024.10","weekly.2024.09","weekly.2024.08","weekly.2024.07","weekly.2024.06","weekly.2024.05","weekly.2024.04","weekly.2024.03","0.4.4","weekly.2024.01.test2","weekly.2024.01.test","weekly.2024.01","weekly.2023.52","weekly.2023.51","weekly.2023.50","weekly.2023.48","weekly.2023.45.1","weekly.2023.45","weekly.2023.44","weekly.2023.43","weekly.2023.42","weekly.2023.41","weekly.2023.40.1","weekly.2023.40","0.4.2","weekly.2023.39","weekly.2023.38","weekly.2023.37","0.4.1","weekly.2023.35","weekly.2023.33","weekly.2023.32.2","weekly.2023.32.1","weekly.2023.32","weekly.2023.31","weekly.2023.30","weekly.2023.28","weekly.2023.27","0.4","0.3.5","weekly.2023.26","weekly.2023.25","weekly.2023.24","weekly.2023.23","weekly.2023.22","weekly.2023.21","weekly.2023.19","0.3.4","weekly.2023.17","weekly.2023.15","weekly.2023.14","weekly.2023.13","weekly.2023.12","weekly.2023.11","weekly.2023.10","weekly.2023.09","weekly.2023.08","weekly.2023.07","weekly.2023.06","weekly.2023.05","0.3.3","weekly.2023.04","weekly.2023.03","weekly.2023.02","weekly.2023.01","weekly.2022.52","weekly.2022.51","weekly.2022.50","weekly.2022.49","weekly.2022.48","weekly.2022.47","weekly.2022.46","weekly.2022.45","0.3.2","weekly.2022.44","weekly.2022.43","weekly.2022.42","weekly.2022.41","weekly.2022.40","weekly.2022.39","weekly.2022.38","weekly.2022.37","weekly.2022.36","0.3.1","weekly.2022.35","weekly.2022.34","weekly.2022.33","weekly.2022.32","weekly.2022.31","weekly.2022.30","weekly.2022.29","weekly.2022.28","0.3","weekly.2022.26","weekly.2022.24","weekly.2022.22","weekly.2022.21","weekly.2022.20","weekly.2022.19","weekly.2022.18","weekly.2022.16","weekly.2022.15","weekly.2022.13","weekly.2022.12","weekly.2022.11","weekly.2022.10","weekly.2022.09","weekly.2022.07","weekly.2022.06","weekly.2022.05","weekly.2022.04","weekly.2022.03","weekly.2022.02","weekly.2022.01","weekly.2021.52.1","weekly.2021.52","weekly.2021.51","weekly.2021.50.3","weekly.2021.50.2","weekly.2021.50.1","weekly.2021.50","weekly.2021.48","weekly.2021.47","weekly.2021.46","weekly.2021.45","weekly.2021.44","weekly.2021.43","weekly.2021.42.1","weekly.2021.42","weekly.2021.41","weekly.2021.39.1","weekly.2021.39","weekly.2021.38","weekly.2021.37","weekly.2021.36","0.2.4","weekly.2021.33.2","weekly.2021.33.1","weekly.2021.33","weekly.2021.32","weekly.2021.31","weekly.2021.30","weekly.2021.29","weekly.2021.28","weekly.2021.27","weekly.2021.26","weekly.2021.25","weekly.2021.24","weekly.2021.23","weekly.2021.22","weekly.2021.21","weekly.2021.20","weekly.2021.19","weekly.2021.18","weekly.2021.17","weekly.2021.16","weekly.2021.15","weekly.2021.14","weekly.2021.13","weekly.2021.12.2","weekly.2021.12.1","weekly.2021.12","weekly.2021.11","weekly.2021.10","weekly.2021.8","weekly.2021.7","weekly.2021.6","weekly.2021.5","0.2.2","0.2","weekly.2020.51.2","weekly.2020.51","weekly.2020.49.5","weekly.2020.49.4","weekly.2020.49.3","weekly.2020.49.2","weekly.2020.49","weekly.2020.48.2","0.1.29","0.1.28.1","0.1.28","0.1.27","0.1.24","0.1.23.1","0.1.23","mytest","0.1.21","0.1.20","0.1.19","0.1.18","0.1.17","0.1.16","0.1.15","v0.1.13","v0.1.12","v0.1.11","v0.1.10","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67201.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N"}]}