SSRF Bypass Vulnerability in V Library

The V library, in versions up to and including 0.5.2, is susceptible to a server-side request forgery (SSRF) bypass vulnerability identified as CVE-2026-67201. The vulnerability stems from a parser differential between the net.urllib library used for validating host allowlists and the net.http library used for executing HTTP requests.

An attacker can exploit this by crafting a URL that incorporates a backslash within the authority section of the URL string. During validation, the net.urllib.parse() function interprets the authority in a manner that validates against a trusted, allowlisted host. However, when the net.http.get() function processes the same URL, it normalizes the backslash character, causing the request to be routed to an unintended internal host or private network service. This effectively allows an attacker to bypass security boundaries intended to restrict outbound traffic, facilitating the reconnaissance and interaction with internal-only services. This issue was addressed in commit 85859f0.

Impact

Successful exploitation of this vulnerability allows unauthorized access to internal network services that are otherwise protected by host-based filtering. This impact is significant in environments where the V library is utilized to perform requests on behalf of users, potentially leading to unauthorized data exposure, interaction with internal APIs, or further exploitation of services behind a firewall or perimeter security.

Recommendation

1. Upgrade the V library to a version containing the patch for commit 85859f0.
2. Implement strict network-level egress filtering to prevent internal-only services from being reached by the host running the application.
3. Validate and sanitize user-provided URLs using a standardized library that ensures consistent parsing behavior across all application components.