{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/v-0.5.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-67201"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["V (0.5.2)"],"_cs_severities":["high"],"_cs_tags":["ssrf","vulnerability","web-security"],"_cs_type":"advisory","_cs_vendors":["V"],"content_html":"\u003cp\u003eThe V library, in versions up to and including 0.5.2, is susceptible to a server-side request forgery (SSRF) bypass vulnerability identified as CVE-2026-67201. The vulnerability stems from a parser differential between the net.urllib library used for validating host allowlists and the net.http library used for executing HTTP requests.\u003c/p\u003e\n\u003cp\u003eAn attacker can exploit this by crafting a URL that incorporates a backslash within the authority section of the URL string. During validation, the net.urllib.parse() function interprets the authority in a manner that validates against a trusted, allowlisted host. However, when the net.http.get() function processes the same URL, it normalizes the backslash character, causing the request to be routed to an unintended internal host or private network service. This effectively allows an attacker to bypass security boundaries intended to restrict outbound traffic, facilitating the reconnaissance and interaction with internal-only services. This issue was addressed in commit 85859f0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized access to internal network services that are otherwise protected by host-based filtering. This impact is significant in environments where the V library is utilized to perform requests on behalf of users, potentially leading to unauthorized data exposure, interaction with internal APIs, or further exploitation of services behind a firewall or perimeter security.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the V library to a version containing the patch for commit 85859f0.\u003c/li\u003e\n\u003cli\u003eImplement strict network-level egress filtering to prevent internal-only services from being reached by the host running the application.\u003c/li\u003e\n\u003cli\u003eValidate and sanitize user-provided URLs using a standardized library that ensures consistent parsing behavior across all application components.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-07-29T19:18:01Z","date_published":"2026-07-29T19:18:01Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ssrf-bypass-v/","summary":"The V library (versions 0.5.2 and below) contains a server-side request forgery (SSRF) bypass vulnerability allowing attackers to circumvent host-based allowlists via URL parsing differentials.","title":"SSRF Bypass Vulnerability in V Library","url":"https://feed.craftedsignal.io/briefs/2026-07-ssrf-bypass-v/"}],"language":"en","title":"CraftedSignal Threat Feed - V (0.5.2)","version":"https://jsonfeed.org/version/1.1"}