CVE-2026-82509

Name of the Vulnerable Software and Affected Versions V programming language versions prior to 0.5.2 commit 4077484

Description The standard library net.http contains a TLS certificate validation bypass. This occurs because SSLConnectConfig.validate and FetchConfig.validate default to false, allowing TLS handshakes to complete without verifying certificates in both mbedtls and OpenSSL backends. An on-path attacker can intercept, read, or modify HTTPS traffic by presenting an expired, self-signed, wrong-hostname, or untrusted-root certificate when the client uses http.get, http.post, or http.fetch without explicitly setting validate: true.

Recommendations Update V programming language to version 0.5.2 commit 4077484 or later. As a temporary mitigation, explicitly configure validate: true when using http.get, http.post, or http.fetch to ensure certificates are verified.