{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3avlangv/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vlang:v:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-82509"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-82509\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["V programming language standard library (\u003c= 0.5.2)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","tls","encryption","library"],"_cs_type":"advisory","_cs_vendors":["V Programming Language"],"content_html":"\u003cp\u003eThe net.http library in the V programming language, specifically in versions up to 0.5.2, contains a TLS certificate validation bypass. The configuration parameters SSLConnectConfig.validate and FetchConfig.validate are set to false by default. Consequently, both mbedtls and OpenSSL backends complete TLS handshakes without verifying server certificates. This vulnerability allows an on-path attacker to present invalid, expired, self-signed, or untrusted-root certificates, successfully intercepting or modifying traffic from http.get, http.post, or http.fetch operations. Developers must explicitly set validate: true to secure these connections.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for machine-in-the-middle attacks where an attacker can intercept, view, or modify sensitive data transmitted over HTTPS. The risk is present in any application built with V versions 0.5.2 and earlier that relies on the default net.http library behavior for HTTPS requests.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify applications written in the V programming language that utilize the net.http library.\u003c/li\u003e\n\u003cli\u003eUpdate the V language toolchain to a version containing commit 4077484 or later.\u003c/li\u003e\n\u003cli\u003eAudit all occurrences of http.get, http.post, and http.fetch in existing codebases to ensure that validation is explicitly enabled by setting the validate parameter to true.\u003c/li\u003e\n\u003cli\u003eMonitor network egress from services utilizing the V language for unexpected TLS certificate mismatches or unusual certificate trust chains if visibility allows.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T16:59:52Z","date_published":"2026-11-10T16:39:04Z","id":"https://feed.craftedsignal.io/briefs/2026-11-v-lang-net-http-tls-bypass/","summary":"The V programming language net.http library through version 0.5.2 fails to validate TLS certificates by default, enabling on-path attackers to perform interception or modification of HTTPS traffic.","title":"V programming language: net.http library TLS certificate validation bypass (CVE-2026-82509)","url":"https://feed.craftedsignal.io/briefs/2026-11-v-lang-net-http-tls-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:vlang:v:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}