CVE-2026-67201: SSRF Bypass Vulnerability in V Library

CVE-2026-67201 Overview

CVE-2026-67201 is a server-side request forgery (SSRF) bypass vulnerability in the V programming language standard library, affecting versions through 0.5.2. The flaw exists because net.urllib and net.http parse URL authorities differently. An attacker can craft a URL containing a backslash in the authority section so that net.urllib.parse() extracts a trusted host for allowlist validation, while net.http.get() normalizes the backslash and connects to an internal host instead. Applications that rely on host-based allowlists to restrict outbound requests can be tricked into reaching internal network services. The issue is fixed in commit 85859f0.

Critical Impact
Attackers can bypass URL allowlists in V applications to reach internal services, resulting in high confidentiality impact against subsequent systems (CWE-436, Interpretation Conflict).

Affected Products

V programming language standard library (net.urllib, net.http)
V releases through version 0.5.2
Applications built with V that use host-based allowlists for outbound HTTP requests

Discovery Timeline

2026-07-29 - CVE-2026-67201 published to NVD
2026-07-29 - Last updated in NVD database
Patch commit - Fix landed in vlang/v commit 85859f0 via pull request #27947, tracked in issue #27945

Technical Details for CVE-2026-67201

Vulnerability Analysis

The defect is a parser differential between two components of V's standard library. net.urllib.parse() accepts a URL that contains a backslash character in the authority section and returns the substring before the backslash as the host. Application code then compares that extracted host against an allowlist and permits the request. When the same URL is passed to net.http.get(), the HTTP client normalizes the backslash (treating it similarly to a forward slash path delimiter) so that the connection target becomes a different host, typically an internal address. The two components disagree on where the authority ends, and the security decision is made against the wrong value. This is classified under CWE-436: Interpretation Conflict.

Root Cause

The authority parser in vlib/net/urllib/urllib.v treated the backslash (\) as a valid userinfo/host character. The HTTP client did not agree with that interpretation and used a different host when opening the socket. The security check and the network operation therefore acted on inconsistent representations of the same input.

Attack Vector

An attacker supplies a URL such as http://trusted.example.com\@169.254.169.254/latest/meta-data/ to a V application that fetches user-controlled URLs. net.urllib.parse() returns trusted.example.com as the host, passing the allowlist. net.http.get() normalizes the backslash and connects to 169.254.169.254, reaching cloud metadata or other internal services. Exploitation requires only network access to the vulnerable application and no authentication or user interaction.

text

// Security patch in vlib/net/urllib/urllib.v (commit 85859f0)
// net.urllib: reject backslashes in URL authorities (#27947)

		// we could possibly allow, and parse will reject them if we
		// escape them (because hosts can`t use %-encoding for
		// ASCII bytes).
-		if c in [`!`, `$`, `&`, `\\`, `(`, `)`, `*`, `+`, `,`, `;`, `=`, `:`, `[`, `]`, `<`, `>`,
+		if c in [`!`, `$`, `&`, `'`, `(`, `)`, `*`, `+`, `,`, `;`, `=`, `:`, `[`, `]`, `<`, `>`,
			`"`] {
			return false
		}

Source: vlang/v commit 85859f0. The patch removes the backslash from the list of characters accepted in URL authorities, forcing net.urllib to reject the malformed URL before any allowlist check runs.

Detection Methods for CVE-2026-67201

Indicators of Compromise

Outbound HTTP requests from V-based services to link-local addresses such as 169.254.169.254 or RFC1918 ranges that are not part of normal application behavior.
Application logs showing user-supplied URLs that contain a backslash (\) in the authority section, especially between a hostname and an @ or path delimiter.
Discrepancies between the host recorded by application-layer allowlist logic and the destination IP resolved at the socket layer.

Detection Strategies

Inspect HTTP request logs and reverse proxies for URLs where the authority contains \, %5C, or mixed slash sequences before the first / path separator.
Add unit tests that pass known parser-differential payloads to any V code performing net.urllib.parse() followed by net.http.get() and assert both agree on the final host.
Use egress monitoring to correlate destination IPs of V processes against the allowlisted hostnames recorded by the application.

Monitoring Recommendations

Alert on any outbound connection from V application hosts to cloud metadata endpoints (169.254.169.254, fd00:ec2::254, metadata.google.internal).
Baseline expected external destinations for V services and flag deviations, particularly connections to internal RFC1918 ranges.
Capture full URL strings, not just resolved hosts, in application logs so parser-differential payloads remain visible during incident review.

How to Mitigate CVE-2026-67201

Immediate Actions Required

Upgrade V to a build that includes commit 85859f0 or later, which rejects backslashes in URL authorities.
Audit application code that combines net.urllib.parse() with net.http.get() for allowlist enforcement and confirm both use the patched library.
Restrict network egress from V application hosts so cloud metadata services and internal management interfaces are unreachable regardless of URL parsing behavior.

Patch Information

The fix is available in vlang/v pull request #27947, merged as commit 85859f0. See the VulnCheck Security Advisory and GitHub Issue #27945 for background.

Workarounds

Reject any input URL that contains a backslash or percent-encoded backslash (%5C) before invoking net.urllib.parse().
Resolve the URL once, extract the host after normalization, and pass the fully resolved URL, not the original user input, to the HTTP client.
Enforce SSRF protection at the network layer with an egress proxy that validates destination hosts independently of the application's parser.

bash

# Configuration example: block V applications from reaching cloud metadata
# iptables egress rule applied on hosts running V services
iptables -A OUTPUT -m owner --uid-owner vapp \
  -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner vapp \
  -d 169.254.170.2 -j REJECT