Executive brief
A vulnerability in the V programming language's standard library could allow attackers to bypass security filters designed to restrict network access. By using specially crafted web addresses, an attacker can trick an application into connecting to internal servers or private data that should be protected. This could lead to the exposure of sensitive internal information or unauthorized access to corporate infrastructure.
Technical details
A server-side request forgery (SSRF) bypass exists in the V programming language (vlang) due to an interpretation conflict (CWE-436) between net.urllib and net.http. The net.urllib.parse() function incorrectly handles backslashes in the authority section of a URL, causing it to extract a different host than the one used by net.http.get() during the actual connection. An attacker can provide a URL like 'http://internal-host\@trusted-host.com/' where the parser validates 'trusted-host.com' against an allowlist, but the HTTP client normalizes the backslash and connects to 'internal-host'. This allows for the circumvention of host-based security controls to access internal network services. The issue is fixed in commit 85859f0 by rejecting backslashes in URL authorities.
Affected products
- vlang v through 0.5.2
Timeline
- 2026-07-26: patched: Fix merged in commit 85859f0
- 2026-07-29: disclosed: NVD publication date