V programming language: net.http library TLS certificate validation bypass (CVE-2026-82509)

The net.http library in the V programming language, specifically in versions up to 0.5.2, contains a TLS certificate validation bypass. The configuration parameters SSLConnectConfig.validate and FetchConfig.validate are set to false by default. Consequently, both mbedtls and OpenSSL backends complete TLS handshakes without verifying server certificates. This vulnerability allows an on-path attacker to present invalid, expired, self-signed, or untrusted-root certificates, successfully intercepting or modifying traffic from http.get, http.post, or http.fetch operations. Developers must explicitly set validate: true to secure these connections.

Impact

Successful exploitation allows for machine-in-the-middle attacks where an attacker can intercept, view, or modify sensitive data transmitted over HTTPS. The risk is present in any application built with V versions 0.5.2 and earlier that relies on the default net.http library behavior for HTTPS requests.

Recommendation

• Identify applications written in the V programming language that utilize the net.http library.
• Update the V language toolchain to a version containing commit 4077484 or later.
• Audit all occurrences of http.get, http.post, and http.fetch in existing codebases to ensure that validation is explicitly enabled by setting the validate parameter to true.
• Monitor network egress from services utilizing the V language for unexpected TLS certificate mismatches or unusual certificate trust chains if visibility allows.