---
id: "CVE-2026-82509"
page: "https://infrastack.ai/live/CVE-2026-82509"
kind: "vulnerability"
aliases: ["CVE-2026-82509"]
title: "V standard library net.http skips TLS certificate checks by default"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["net.http", "runtime", "tls", "v"]
not_affected_if: ["no-https-calls", "validate-true"]
published_at: "2026-11-10T14:17:36+00:00"
first_seen_at: "2026-11-10T14:22:20+00:00"
updated_at: "2026-11-10T14:23:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82509", "first_seen_at": "2026-11-10T14:22:20+00:00"}]
exploit_sources: []
---

# V standard library net.http skips TLS certificate checks by default

Link for people: https://infrastack.ai/live/CVE-2026-82509 (this .md is for agents)

The V language's net.http module completes HTTPS handshakes without verifying certificates by default, in both the mbedtls and OpenSSL backends. An on-path attacker can present a bad certificate and read or modify HTTPS traffic made through http.get, http.post or http.fetch.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Search the code for `http.get`, `http.post` or `http.fetch` calls over HTTPS.
- Check whether `validate: true` is set on `SSLConnectConfig` or `FetchConfig`; if not, the default applies.
- Check the V version in use against `0.5.2`.

## Fix

- Move to a V version newer than `0.5.2` that includes commit `4077484`, per the linked patch.
- Set `validate: true` explicitly on `SSLConnectConfig` and `FetchConfig` until upgraded.

## Timeline

- 2026-11-10T14:22:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82509

## Documents

- [advisory] Vendor advisory: github.com https://github.com/vlang/v/security/advisories/GHSA-7g66-88pm-6gv6
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/v-programming-language-net-http-tls-certificate-validation-bypass
- [fix] Patch: github.com https://github.com/vlang/v/commit/40774847a949722f5d090706c050b806ceeacfd1

## From the sources

V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_