Loading story…
A high-severity server-side request forgery flaw tracked as CVE-2026-67201 affects the V programming language through version 0.5.2, allowing remote attackers to bypass host-based allowlists. The issue arises from a parser differential between net.urllib and net.http: net.urllib.parse() can validate a seemingly trusted host, while net.http.get() later normalizes a backslash in the URL authority field and connects to an internal destination instead.
The vulnerability was addressed in merged commit 85859f0 through a change titled "net.urllib: reject backslashes in URL authorities", with accompanying tests for vlib/net/urllib and vlib/net/http. Published guidance recommends upgrading to a patched release and reviewing applications to ensure URL normalization and host validation are performed consistently across parsing and request-handling components.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The V project merged commit 85859f0 into master to harden net.urllib by rejecting backslashes in URL authority fields, with related tests for net.urllib and net.http. This change is identified as the fix for the later-tracked SSRF bypass issue.
CVE-2026-67201 was publicly disclosed as a high-severity SSRF bypass affecting V through version 0.5.2. The flaw was described as a parser differential between net.urllib and net.http that could let attackers bypass host-based allowlists by using a backslash in the URL authority section.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcevulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity server-side request forgery flaw tracked as **CVE-2026-54690** affects `datamodel-code-generator` when it processes attacker-controlled JSON Schema `$ref` values pointing to `http` or `https` URLs. In vulnerable releases, the tool silently resolves remote references during schema processing, allowing outbound requests to arbitrary destinations; one report places the affected range at **0.9.1 through 0.60.x**, while another indicates exposure through **0.61.0**. The issue has a **CVSS v3.1 score of 8.2** and is tied to schema resolution and HTTP fetch logic in files including `jsonschema.py` and `http.py`. Researchers said the vulnerable code passes untrusted URLs directly to the HTTP client, follows redirects, and does not adequately restrict hostnames, ports, or IP ranges, creating a path to reach internal services such as `127.0.0.1` and cloud metadata endpoints like `169.254.169.254`. Fetched content may also be incorporated into generated output, raising information disclosure risk in addition to SSRF. The issue is fixed in **version 0.61.0**, with the patch adding URL validation and blocking localhost-style and non-global IP targets unless private-network access is explicitly enabled; recommended mitigations include disabling remote reference resolution or blocking private-network access.
Jul 29, 2026
A high-severity server-side request forgery flaw tracked as **CVE-2026-10582** affects **Hugo 0.91.0 through 0.165.0**. The issue lies in outbound fetches performed by `resources.GetRemote`, where `security.http.urls` validates only the supplied URL text and some canonicalized IPv4 variants, but does not resolve hostnames or verify the destination IP at connection time. That gap allows attacker-controlled hostnames to pass policy checks even if they ultimately resolve to loopback, private-network, or cloud-metadata addresses. If an attacker can influence a URL through front matter, site content, or a CMS field, Hugo’s build process can retrieve internal resources and embed the response into the generated static site, creating a path for data exfiltration through published artifacts. Hugo’s security code already includes SSRF-focused checks such as blocking localhost-style URL patterns, userinfo in URLs, and alternate IPv4 encodings, but the advisory says those protections do not enforce dial-time destination validation. The vulnerability is classified as **CWE-918** and has been scored **7.4 CVSS v3.1** and **8.3 CVSS v4.0**.
Aug 24, 2026
Vercel has patched three high-severity vulnerabilities in **Next.js** that could allow **server-side request forgery (SSRF)** and, in a narrower configuration, bypass middleware-based authentication. The flaws are tracked as `CVE-2026-64645`, `CVE-2026-64649`, and `CVE-2026-64642`, each rated **CVSS 8.3**, and affect multiple supported branches of the framework. According to the advisory coverage, the SSRF issues can be triggered under specific configurations, while the authentication bypass affects deployments using the **App Router** and **Turbopack** in a limited scenario. The issues were fixed in **Next.js 16.2.11** and **15.5.21**, with no public proof-of-concept or confirmed in-the-wild exploitation reported at publication time. Defenders are advised to upgrade promptly, avoid user-controlled external destination hostnames, validate `Host` and `X-Forwarded-Host` headers, and enforce authorization checks in server-side page logic rather than relying solely on middleware protections.
Jul 23, 2026