V Programming Language - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/v-programming-language/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 16:39:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgV programming language: net.http library TLS certificate validation bypass (CVE-2026-82509)https://feed.craftedsignal.io/briefs/2026-11-v-lang-net-http-tls-bypass/Tue, 10 Nov 2026 16:39:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-v-lang-net-http-tls-bypass/The V programming language net.http library through version 0.5.2 fails to validate TLS certificates by default, enabling on-path attackers to perform interception or modification of HTTPS traffic.The net.http library in the V programming language, specifically in versions up to 0.5.2, contains a TLS certificate validation bypass. The configuration parameters SSLConnectConfig.validate and FetchConfig.validate are set to false by default. Consequently, both mbedtls and OpenSSL backends complete TLS handshakes without verifying server certificates. This vulnerability allows an on-path attacker to present invalid, expired, self-signed, or untrusted-root certificates, successfully intercepting or modifying traffic from http.get, http.post, or http.fetch operations. Developers must explicitly set validate: true to secure these connections.

Impact

Successful exploitation allows for machine-in-the-middle attacks where an attacker can intercept, view, or modify sensitive data transmitted over HTTPS. The risk is present in any application built with V versions 0.5.2 and earlier that relies on the default net.http library behavior for HTTPS requests.

Recommendation

  • Identify applications written in the V programming language that utilize the net.http library.
  • Update the V language toolchain to a version containing commit 4077484 or later.
  • Audit all occurrences of http.get, http.post, and http.fetch in existing codebases to ensure that validation is explicitly enabled by setting the validate parameter to true.
  • Monitor network egress from services utilizing the V language for unexpected TLS certificate mismatches or unusual certificate trust chains if visibility allows.
]]>highadvisoryvulnerabilitytlsencryptionlibrary