V Programming Language net.http TLS Certificate Validation Bypass

published 2026-11-08 3d ago modified 2026-11-10 yesterday also EUVD-2026-121044 , GHSA-7g66-88pm-6gv6

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository vlang/v. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured.

Patch / fix

links 1

github.com/vlang/v@4077484 commit

Is CVE-2026-82509 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.1	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA	4.0	9.1	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

vlang v

Classification

Weakness

CWE-295 Improper Certificate Validation

References

github.com /vlang/v/commit/40774847a949722f5d090706c050b806ceeacfd1
issue-tracking, patch
github.com /vlang/v/security/advisories/GHSA-7g66-88pm-6gv6
vendor-advisory, advisory
vulncheck.com /advisories/v-programming-language-net-http-tls-certificate-validation-bypass
third-party-advisory

Sources

CVE List CVE-2026-82509
NVD CVE-2026-82509
Maintainer advisory GHSA-7g66-88pm-6gv6

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of vlang/v published their own advisory on GitHub. Reviewed sources take precedence over it.