V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allo…

V programming language versions through 0.5.2 contain a server-side request forgery (SSRF) bypass vulnerability. The flaw exploits a parser differential between net.urllib and net.http modules. Attackers can craft URLs with backslashes in the authority section to bypass host-based allowlist validation. net.urllib.parse() extracts the trusted host for allowlist checks while net.http.get() normalizes the backslash and connects to an unintended internal host. This enables unauthorized access to internal network services that allowlists were designed to block. The vulnerability has been fixed in commit 85859f0f3498d4091b38009c45ed390a97eeedc2. The issue was tracked and addressed via GitHub issue #27945 and pull request #27947.