EUVD-2026-50446
GHSA-mvrj-5wv7-cfg9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity SSRF bypass with no direct impact on the app but scope change (S:C) granting high confidentiality access to internal systems; no integrity/availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.
AnalysisAI
Server-side request forgery allowlist bypass in the V programming language standard library (net.urllib / net.http) through version 0.5.2 lets remote unauthenticated attackers reach internal network services that a host-based allowlist was meant to block. The flaw stems from a parser differential: net.urllib.parse() and net.http.get() disagree on how a backslash in a URL's authority is handled, so validation and connection resolve to different hosts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a V application (≤ 0.5.2) use net.urllib.parse() to extract and allowlist the host of an attacker-controllable URL and then fetch that same URL string with net.http (get/request) - the SSRF-allowlist pattern is the concrete prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are broadly consistent for a real, exploitable SSRF-class issue rather than a paper-high score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A V-based web service accepts a user-supplied URL (e.g. a webhook, link preview, or image-fetch feature) and allowlists it against trusted external hosts before fetching. … |
| Remediation | Upstream fix available (commit 85859f0 / PR #27947); a released, tagged patched version is not independently confirmed from the provided data, so update V to a build that includes commit 85859f0f3498d4091b38009c45ed390a97eeedc2 (verify against the vlang release notes) - see https://github.com/vlang/v/commit/85859f0f3498d4091b38009c45ed390a97eeedc2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all systems and applications deployed with V programming language version 0.5.2 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-436 – Interpretation Conflict
View allShare
External POC / Exploit Code
Leaving vuln.today