High [CVE-2026-67201] Server-Side Request Forgery (SSRF) bypass due to URL parser differential

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery (SSRF) bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http.

Attackers can craft a URL containing a backslash in the authority section such that net.urllib.parse() extracts the trusted host for allowlist validation while net.http.get() normalizes the backslash and connects to the internal host, enabling access to internal network services that the allowlist was intended to block.

A flaw was found in V, specifically within its `net.urllib` and `net.http` components. This vulnerability allows a remote attacker to bypass host-based allowlists by exploiting a difference in how URLs are parsed.

By crafting a malicious URL with a backslash, an attacker can trick the system into validating a trusted host while actually connecting to an internal network service. This enables unauthorized access to internal resources that should otherwise be protected.

This flaw allows a remote attacker to circumvent host-based allowlists by exploiting a URL parser differential, enabling unauthorized access to internal network services. Applications utilizing these components for URL validation and fetching are at risk of exposing internal resources.