V (vlang) EUVD-2026-50446

Exploitation requires that a V application (≤ 0.5.2) use net.urllib.parse() to extract and allowlist the host of an attacker-controllable URL and then fetch that same URL string with net.http (get/request) - the SSRF-allowlist pattern is the concrete prerequisite. The attacker crafts a URL with a backslash in the authority section (e.g. http://allowed-host\@internal-target/) so parsing sees the trusted host but the HTTP client normalizes the backslash and connects to the internal host. No authentication, no user interaction, and no non-default library configuration is needed (PR:N/UI:N). Limiting factors: the vulnerability is inert unless the downstream app actually performs urllib-based allowlist validation in front of net.http, and reachable internal targets must exist on the network the V service can route to; the raw library bug alone does not compromise the host running it.

Signals are broadly consistent for a real, exploitable SSRF-class issue rather than a paper-high score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction, and the impact profile (VC:N/VI:N/VA:N but SC:H) correctly models SSRF: the vulnerable app itself suffers no direct CIA loss, but a subsequent system's confidentiality is highly impacted (access to internal services). A public POC exists and a working exploit URL is documented, which raises practical risk. Counterweights: exploitability depends entirely on a downstream V application actually using urllib-based allowlist validation in front of net.http - the library flaw is not self-exploiting, so real-world exposure is bounded by that coding pattern and by V's modest deployment footprint. No EPSS score was provided and the CVE is not in CISA KEV, so widespread or automated exploitation is not evidenced; treat this as a targeted, developer-dependent risk. One caveat to verify: CVSS lists VC:N while the real-world consequence is data exfiltration from internal services (captured under SC:H) - defenders should read the subsequent-system metric, not the vulnerable-system one, when judging impact.

A V-based web service accepts a user-supplied URL (e.g. a webhook, link preview, or image-fetch feature) and allowlists it against trusted external hosts before fetching. An attacker submits http://trusted.example.com\@169.254.169.254/latest/meta-data/, which urllib.parse() validates as the trusted host while net.http.get() actually connects to the internal metadata endpoint, exfiltrating cloud credentials. A public POC demonstrating the backslash bypass is available, and the low attack complexity (AC:L, no auth, no user interaction) makes this trivially repeatable once the vulnerable pattern is present.