Threats tagged 'ghsa-35rr-q46f-rh89'

The V programming language standard library net.http up to version 0.5.2 contains a TLS certificate validation bypass vulnerability. This flaw arises because the default configuration for SSLConnectConfig.validate and FetchConfig.validate is false, causing TLS handshakes to complete without verifying certificates in both mbedtls and OpenSSL backends. As a result, attackers can intercept or modify HTTPS traffic by presenting invalid certificates such as expired, self-signed, wrong-hostname, or untrusted-root certificates unless the validate option is explicitly set to true.