CVE-2026-67201: Interpretation Conflict
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.
AI Analysis
Technical Summary
CVE-2026-67201 is an SSRF bypass vulnerability in Vlang up to version 0.5.2. The vulnerability arises from a parsing discrepancy where net.urllib.parse() extracts the host for allowlist validation without normalizing backslashes, while net.http.get() normalizes backslashes and connects to the resulting host. Attackers can exploit this by crafting URLs with backslashes in the authority section, causing allowlist checks to pass while the HTTP client connects to an internal host, circumventing intended network restrictions. The vulnerability is fixed in commit 85859f0, which presumably aligns the parsing behavior.
Potential Impact
An attacker can bypass host-based allowlists intended to restrict access to internal network services, potentially allowing unauthorized internal network access via SSRF. This could lead to exposure of sensitive internal resources or services that the allowlist was designed to protect.
Mitigation Recommendations
A fix is available in Vlang starting from version 0.5.3, which addresses the parsing inconsistency. Users should upgrade to version 0.5.3 or later to remediate this vulnerability. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the fix commit, so users should verify the vendor advisory for the latest remediation guidance.
CVE-2026-67201: Interpretation Conflict
Description
V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.
CVSS v4.0
Score 7.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-67201 is an SSRF bypass vulnerability in Vlang up to version 0.5.2. The vulnerability arises from a parsing discrepancy where net.urllib.parse() extracts the host for allowlist validation without normalizing backslashes, while net.http.get() normalizes backslashes and connects to the resulting host. Attackers can exploit this by crafting URLs with backslashes in the authority section, causing allowlist checks to pass while the HTTP client connects to an internal host, circumventing intended network restrictions. The vulnerability is fixed in commit 85859f0, which presumably aligns the parsing behavior.
Potential Impact
An attacker can bypass host-based allowlists intended to restrict access to internal network services, potentially allowing unauthorized internal network access via SSRF. This could lead to exposure of sensitive internal resources or services that the allowlist was designed to protect.
Mitigation Recommendations
A fix is available in Vlang starting from version 0.5.3, which addresses the parsing inconsistency. Users should upgrade to version 0.5.3 or later to remediate this vulnerability. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the fix commit, so users should verify the vendor advisory for the latest remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-28T16:06:49.774Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a6a48789c2644c7f8e51594
Added to database: 07/29/2026, 18:37:44 UTC
Last enriched: 07/29/2026, 18:52:14 UTC
Last updated: 07/29/2026, 19:23:01 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.