{"id":"CVE-2026-82509","kind":"vulnerability","aliases":["CVE-2026-82509"],"related":[],"title":"V standard library net.http skips TLS certificate checks by default","description":"V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured.","summary":"The V language's net.http module completes HTTPS handshakes without verifying certificates by default, in both the mbedtls and OpenSSL backends. An on-path attacker can present a bad certificate and read or modify HTTPS traffic made through http.get, http.post or http.fetch.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["net.http","runtime","tls","v"],"not_affected_if":["no-https-calls","validate-true"],"how_to_check":"- Search the code for `http.get`, `http.post` or `http.fetch` calls over HTTPS.\n- Check whether `validate: true` is set on `SSLConnectConfig` or `FetchConfig`; if not, the default applies.\n- Check the V version in use against `0.5.2`.","fix":"- Move to a V version newer than `0.5.2` that includes commit `4077484`, per the linked patch.\n- Set `validate: true` explicitly on `SSLConnectConfig` and `FetchConfig` until upgraded.","status":"open","published_at":"2026-11-10T14:17:36+00:00","first_seen_at":"2026-11-10T14:22:20+00:00","triaged_at":"2026-11-10T14:23:52+00:00","updated_at":"2026-11-10T14:23:52+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T14:23:52Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a V version newer than `0.5.2` that includes commit `4077484`, per the linked patch.\n- Set `validate: true` explicitly on `SSLConnectConfig` and `FetchConfig` until upgraded.","reach":"network","title":"V standard library net.http skips TLS certificate checks by default","impact":"high","summary":"The V language's net.http module completes HTTPS handshakes without verifying certificates by default, in both the mbedtls and OpenSSL backends. An on-path attacker can present a bad certificate and read or modify HTTPS traffic made through http.get, http.post or http.fetch.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["v","net.http","tls"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"HTTPS traffic intercepted and modified by an on-path attacker","analyst_note":"","how_to_check":"- Search the code for `http.get`, `http.post` or `http.fetch` calls over HTTPS.\n- Check whether `validate: true` is set on `SSLConnectConfig` or `FetchConfig`; if not, the default applies.\n- Check the V version in use against `0.5.2`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["validate-true","no-https-calls"],"who_is_affected":"Any V program that makes HTTPS requests with net.http using the default config is exposed to certificate-check bypass from a network path the attacker controls. Programs that set validate: true explicitly are not affected by the default. Programs making no HTTPS calls can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000777,"input_tokens":4731,"output_tokens":607,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82509':13A,16A '0.5.2':72C '4077484':76C 'allow':85C 'attack':46B,89C,118C 'backend':41B,117C 'bad':50B 'bypass':82C 'certif':7A,32B,51B,80C,110C,133C 'check':8A 'commit':75C 'complet':27B,105C,136C 'configur':156C 'contain':77C 'cve':11A,14A 'default':10A,34B,97C 'enabl':144C 'expir':122C 'explicit':155C 'exploit':95C 'fals':98C 'fetchconfig.validate':103C 'handshak':29B,107C,138C 'hostnam':128C 'http.fetch':63B,143C 'http.get':60B,140C 'http.post':61B,141C 'https':28B,56B,92C,149C 'intercept':91C,145C 'languag':23B,66C 'librari':3A,68C 'made':58B 'mbedtl':38B,114C 'modif':147C 'modifi':55B 'modul':26B 'net.http':4A,17B,25B,69C 'on-path':43B,86C 'openssl':40B,116C 'path':45B,88C 'present':48B,120C 'prior':73C 'program':65C 'read':53B 'root':132C 'runtim':18B 'self':124C 'self-sign':123C 'sign':125C 'skip':5A 'sslconnectconfig.validate':101C 'standard':2A,67C 'success':135C 'tls':6A,19B,79C,106C 'traffic':57B,93C,150C 'true':153C 'unless':151C 'untrust':131C 'untrusted-root':130C 'v':1A,20B,22B,64C 'valid':81C,152C 'valu':99C 'verifi':31B,109C 'version':71C 'via':139C 'vulner':83C 'without':30B,108C 'wrong':127C 'wrong-hostnam':126C","nicknames":[],"mitigations":[],"who_affected":"Any V program that makes HTTPS requests with net.http using the default config is exposed to certificate-check bypass from a network path the attacker controls. Programs that set validate: true explicitly are not affected by the default. Programs making no HTTPS calls can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","nethttp","runtime","tls","v"],"campaign_type":null,"search_a":"'-2026':12A,15A '-82509':13A,16A 'certif':7A 'check':8A 'cve':11A,14A 'default':10A 'librari':3A 'net.http':4A 'skip':5A 'standard':2A 'tls':6A 'v':1A","search_b":"'attack':46B 'backend':41B 'bad':50B 'certif':32B,51B 'complet':27B 'default':34B 'handshak':29B 'http.fetch':63B 'http.get':60B 'http.post':61B 'https':28B,56B 'languag':23B 'made':58B 'mbedtl':38B 'modifi':55B 'modul':26B 'net.http':17B,25B 'on-path':43B 'openssl':40B 'path':45B 'present':48B 'read':53B 'runtim':18B 'tls':19B 'traffic':57B 'v':20B,22B 'verifi':31B 'without':30B","search_c":"'0.5.2':72C '4077484':76C 'allow':85C 'attack':89C,118C 'backend':117C 'bypass':82C 'certif':80C,110C,133C 'commit':75C 'complet':105C,136C 'configur':156C 'contain':77C 'default':97C 'enabl':144C 'expir':122C 'explicit':155C 'exploit':95C 'fals':98C 'fetchconfig.validate':103C 'handshak':107C,138C 'hostnam':128C 'http.fetch':143C 'http.get':140C 'http.post':141C 'https':92C,149C 'intercept':91C,145C 'languag':66C 'librari':68C 'mbedtl':114C 'modif':147C 'net.http':69C 'on-path':86C 'openssl':116C 'path':88C 'present':120C 'prior':73C 'program':65C 'root':132C 'self':124C 'self-sign':123C 'sign':125C 'sslconnectconfig.validate':101C 'standard':67C 'success':135C 'tls':79C,106C 'traffic':93C,150C 'true':153C 'unless':151C 'untrust':131C 'untrusted-root':130C 'v':64C 'valid':81C,152C 'valu':99C 'verifi':109C 'version':71C 'via':139C 'vulner':83C 'without':108C 'wrong':127C 'wrong-hostnam':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T11:04:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82509","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82509","severity":null,"published_at":"2026-11-10T14:17:36+00:00","modified_at":"2026-11-10T14:17:36+00:00","first_seen_at":"2026-11-10T14:22:20+00:00","fetched_at":"2026-11-10T14:22:20+00:00","note":null}],"documents":[{"id":115417,"url":"https://github.com/vlang/v/commit/40774847a949722f5d090706c050b806ceeacfd1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":115418,"url":"https://github.com/vlang/v/security/advisories/GHSA-7g66-88pm-6gv6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-08T11:04:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":115419,"url":"https://www.vulncheck.com/advisories/v-programming-language-net-http-tls-certificate-validation-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}