The vulnerability is a server‑side request forgery (SSRF) bypass that allows an attacker to circumvent host‑based allowlists. By crafting a URL that contains a backslash in the authority section, the attacker exploits a parsing mismatch between net.urllib.parse, which extracts the trusted host for validation, and net.http.get, which normalises the backslash and connects to the intended internal host. The attacker can therefore reach internal network services that the allowlist was designed to protect, potentially exposing confidential data, allowing privilege escalation, or disrupting internal services.

The affected product is V from vlang, specifically version 0.5.2. The vulnerability is fixed in commit 85859f0. No other affected versions are listed.

The CVSS score of 7.7 indicates high severity, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild at this time. The vulnerability is not currently listed in the CISA KEV catalogue. The likely attack vector is remote; an attacker only needs to send a crafted URL to a component that uses net.http.get, which is common in web services. If successful, the attacker gains directed internal access through the server, compromising confidentiality and integrity of internal resources.