Git · V · CVE-2026-67201
**Name of the Vulnerable Software and Affected Versions**
The product name cannot be determined versions prior to 0.5.2
**Description**
A server-side request forgery (SSRF) bypass allows attackers to circumvent host-based allowlists. This occurs due to a parser differential between `net.urllib` and `net.http`. By crafting a URL with a backslash in the authority section, `net.urllib.parse()` extracts a trusted host for validation, while `net.http.get()` normalizes the backslash to connect to an internal host, granting unauthorized access to internal network services.
**Recommendations**
Update to the version containing commit 85859f0.