CVE-2026-67201

Name of the Vulnerable Software and Affected Versions The product name cannot be determined versions prior to 0.5.2

Description A server-side request forgery (SSRF) bypass allows attackers to circumvent host-based allowlists. This occurs due to a parser differential between net.urllib and net.http. By crafting a URL with a backslash in the authority section, net.urllib.parse() extracts a trusted host for validation, while net.http.get() normalizes the backslash to connect to an internal host, granting unauthorized access to internal network services.

Recommendations Update to the version containing commit 85859f0.