CVE-2026-67201

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67201
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67201.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67201
Published
2026-07-29T18:12:34.162Z
Modified
2026-07-30T04:04:33.861436686Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
V 0.5.2 SSRF Bypass via Parser Differential in net.urllib and net.http
Details

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.

Database specific 
{
    "cwe_ids": [
        "CWE-436"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67201.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/vlang/v

Affected ranges

Type
GIT
Repo
https://github.com/vlang/v
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7647ce1c6fad63b5578bc07883139906de74b2f8
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.5.2"
        }
    ]
}

Affected versions

0.*
0.1.15
0.1.16
0.1.17
0.1.18
0.1.19
0.1.20
0.1.21
0.1.23
0.1.23.1
0.1.24
0.1.27
0.1.28
0.1.28.1
0.1.29
0.2
0.2.2
0.2.4
0.3
0.3.1
0.3.2
0.3.3
0.3.4
0.3.5
0.4
0.4.1
0.4.10
0.4.11
0.4.12
0.4.2
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5
0.5.1
0.5.2
Other
mytest
v0.*
v0.1.10
v0.1.11
v0.1.12
v0.1.13
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
weekly.*
weekly.2020.48.2
weekly.2020.49
weekly.2020.49.2
weekly.2020.49.3
weekly.2020.49.4
weekly.2020.49.5
weekly.2020.51
weekly.2020.51.2
weekly.2021.10
weekly.2021.11
weekly.2021.12
weekly.2021.12.1
weekly.2021.12.2
weekly.2021.13
weekly.2021.14
weekly.2021.15
weekly.2021.16
weekly.2021.17
weekly.2021.18
weekly.2021.19
weekly.2021.20
weekly.2021.21
weekly.2021.22
weekly.2021.23
weekly.2021.24
weekly.2021.25
weekly.2021.26
weekly.2021.27
weekly.2021.28
weekly.2021.29
weekly.2021.30
weekly.2021.31
weekly.2021.32
weekly.2021.33
weekly.2021.33.1
weekly.2021.33.2
weekly.2021.36
weekly.2021.37
weekly.2021.38
weekly.2021.39
weekly.2021.39.1
weekly.2021.41
weekly.2021.42
weekly.2021.42.1
weekly.2021.43
weekly.2021.44
weekly.2021.45
weekly.2021.46
weekly.2021.47
weekly.2021.48
weekly.2021.5
weekly.2021.50
weekly.2021.50.1
weekly.2021.50.2
weekly.2021.50.3
weekly.2021.51
weekly.2021.52
weekly.2021.52.1
weekly.2021.6
weekly.2021.7
weekly.2021.8
weekly.2022.01
weekly.2022.02
weekly.2022.03
weekly.2022.04
weekly.2022.05
weekly.2022.06
weekly.2022.07
weekly.2022.09
weekly.2022.10
weekly.2022.11
weekly.2022.12
weekly.2022.13
weekly.2022.15
weekly.2022.16
weekly.2022.18
weekly.2022.19
weekly.2022.20
weekly.2022.21
weekly.2022.22
weekly.2022.24
weekly.2022.26
weekly.2022.28
weekly.2022.29
weekly.2022.30
weekly.2022.31
weekly.2022.32
weekly.2022.33
weekly.2022.34
weekly.2022.35
weekly.2022.36
weekly.2022.37
weekly.2022.38
weekly.2022.39
weekly.2022.40
weekly.2022.41
weekly.2022.42
weekly.2022.43
weekly.2022.44
weekly.2022.45
weekly.2022.46
weekly.2022.47
weekly.2022.48
weekly.2022.49
weekly.2022.50
weekly.2022.51
weekly.2022.52
weekly.2023.01
weekly.2023.02
weekly.2023.03
weekly.2023.04
weekly.2023.05
weekly.2023.06
weekly.2023.07
weekly.2023.08
weekly.2023.09
weekly.2023.10
weekly.2023.11
weekly.2023.12
weekly.2023.13
weekly.2023.14
weekly.2023.15
weekly.2023.17
weekly.2023.19
weekly.2023.21
weekly.2023.22
weekly.2023.23
weekly.2023.24
weekly.2023.25
weekly.2023.26
weekly.2023.27
weekly.2023.28
weekly.2023.30
weekly.2023.31
weekly.2023.32
weekly.2023.32.1
weekly.2023.32.2
weekly.2023.33
weekly.2023.35
weekly.2023.37
weekly.2023.38
weekly.2023.39
weekly.2023.40
weekly.2023.40.1
weekly.2023.41
weekly.2023.42
weekly.2023.43
weekly.2023.44
weekly.2023.45
weekly.2023.45.1
weekly.2023.48
weekly.2023.50
weekly.2023.51
weekly.2023.52
weekly.2024.01
weekly.2024.01.test
weekly.2024.01.test2
weekly.2024.03
weekly.2024.04
weekly.2024.05
weekly.2024.06
weekly.2024.07
weekly.2024.08
weekly.2024.09
weekly.2024.10
weekly.2024.11
weekly.2024.12
weekly.2024.13
weekly.2024.14
weekly.2024.16
weekly.2024.16.1
weekly.2024.17
weekly.2024.18
weekly.2024.18.2
weekly.2024.19
weekly.2024.20
weekly.2024.22
weekly.2024.23
weekly.2024.24
weekly.2024.25
weekly.2024.26
weekly.2024.27
weekly.2024.28
weekly.2024.29
weekly.2024.30
weekly.2024.31
weekly.2024.32
weekly.2024.33
weekly.2024.34
weekly.2024.35
weekly.2024.36
weekly.2024.37
weekly.2024.39
weekly.2024.41
weekly.2024.42
weekly.2024.43
weekly.2024.44
weekly.2024.45
weekly.2024.46
weekly.2024.47
weekly.2024.48
weekly.2024.49
weekly.2024.50
weekly.2024.51
weekly.2024.52
weekly.2024.53
weekly.2025.01
weekly.2025.03
weekly.2025.04
weekly.2025.05
weekly.2025.06
weekly.2025.07
weekly.2025.08
weekly.2025.09
weekly.2025.1
weekly.2025.10
weekly.2025.11
weekly.2025.12
weekly.2025.13
weekly.2025.14
weekly.2025.16
weekly.2025.17
weekly.2025.18
weekly.2025.19
weekly.2025.20
weekly.2025.21
weekly.2025.22
weekly.2025.23
weekly.2025.24
weekly.2025.25
weekly.2025.26
weekly.2025.27
weekly.2025.28
weekly.2025.29
weekly.2025.30
weekly.2025.31
weekly.2025.32
weekly.2025.33
weekly.2025.34
weekly.2025.35
weekly.2025.36
weekly.2025.37
weekly.2025.38
weekly.2025.39
weekly.2025.40
weekly.2025.41
weekly.2025.42
weekly.2025.43
weekly.2025.44
weekly.2025.45
weekly.2025.46
weekly.2025.47
weekly.2025.48
weekly.2025.49
weekly.2025.50
weekly.2025.51
weekly.2025.52
weekly.2026.02
weekly.2026.03
weekly.2026.04
weekly.2026.05
weekly.2026.06
weekly.2026.07
weekly.2026.08

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67201.json"