CVE-2026-82509: V Programming Language net.http TLS Certificate Validation Bypass
V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
V Programming Language net.httpto a version that resolves this vulnerability.Patch 4077484 - Configuration
Explicitly configure SSLConnectConfig.validate and FetchConfig.validate to true so TLS certificates are validated.
V Programming Language net.http SSLConnectConfig.validate and FetchConfig.validate = true
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using V standard-library net.http through version 0.5.2 prior to commit 4077484 are exposed when they make HTTPS requests with http.get, http.post, or http.fetch without explicitly enabling certificate validation. The issue affects both the mbedtls and OpenSSL backends.
What does an attacker need to exploit it?
An attacker must be able to intercept or sit on the network path for the application's HTTPS traffic. They can complete the TLS handshake using an expired, self-signed, wrong-hostname, or untrusted-root certificate.
Are default settings affected?
Yes. SSLConnectConfig.validate and FetchConfig.validate default to false, so certificate verification is not performed unless validate: true is explicitly configured.
What can be done before updating the affected library?
Explicitly configure validate: true for HTTPS requests so that TLS certificates are verified. This prevents the described acceptance of invalid certificates.