What’s Vulnerable › Vulnerabilities

CVE-2026-56860: Avoid quadratic complexity in resolvePath in net/url

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-13 · updated 2026-09-03
• Weakness: CWE-407

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Affected products

• Go Stdlib: before 1.25.13; from 1.26.0-0 before 1.26.6; from 1.27.0-0 before 1.27.0-rc.3 — fixed in 1.25.13, 1.26.6, 1.27.0-rc.3
• Go standard library net/url: before 1.25.13; from 1.26.0-0 before 1.26.6; from 1.27.0-0 before 1.27.0-rc.3 — fixed in 1.25.13, 1.26.6, 1.27.0-rc.3

How to fix

Upgrade to a fixed version: Go Stdlib 1.25.13, 1.26.6, 1.27.0-rc.3; Go standard library net/url 1.25.13, 1.26.6, 1.27.0-rc.3. Check the vendor advisory for mitigations.

References

• https://go.dev/cl/803681
• https://go.dev/issue/80494
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6218

Get alerted when CVE-2026-56860 or the next vulnerability affects your stack