GHSA-7g66-88pm-6gv6: V Programming Language net.http TLS Certificate Validation Bypass
V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS certificate validation bypass vulnerability that allows on-path attackers to intercept HTTPS traffic by exploiting the default false value of SSLConnectConfig.validate and FetchConfig.validate, which completes TLS handshakes without verifying certificates in both the mbedtls and OpenSSL backends. Attackers can present an expired, self-signed, wrong-hostname, or untrusted-root certificate to successfully complete the handshake via http.get, http.post, or http.fetch, enabling interception or modification of HTTPS traffic unless validate: true is explicitly configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
V Programming Language net.httpto a version that resolves this vulnerability.Patch 4077484 - Configuration
Explicitly configure SSLConnectConfig.validate and FetchConfig.validate to true so TLS certificates are verified.
V Programming Language net.http SSLConnectConfig.validate and FetchConfig.validate = true
Event History
Frequently Asked Questions
Which applications are exposed in practice?
Applications using net.http http.get, http.post, or http.fetch are exposed when certificate validation is left at its default setting. The issue affects both the mbedtls and OpenSSL backends.
What does an attacker need to exploit this issue?
An attacker must be able to intercept or position themselves on the network path for the HTTPS connection. They can use an expired, self-signed, wrong-hostname, or untrusted-root certificate; no client interaction or authentication is required.
What can be done before updating the library?
Explicitly configure validate: true in SSLConnectConfig and FetchConfig for all affected HTTPS requests. This prevents TLS handshakes from completing when the presented certificate fails validation.
How can I determine whether my code needs remediation?
Review uses of http.get, http.post, and http.fetch in affected net.http versions, particularly code that does not explicitly set validate: true. Builds through version 0.5.2 that are prior to commit 4077484 are identified as affected.