CVE-2026-56860 PUBLISHED

Avoid quadratic complexity in resolvePath in net/url

Assigner: Go
Reserved: 23.06.2026 Published: 13.08.2026 Updated: 13.08.2026

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Product Status

Vendor Go standard library
Product net/url
Versions Default: unaffected
  • affected from 0 to 1.25.13 (excl.)
  • affected from 1.26.0-0 to 1.26.6 (excl.)
  • affected from 1.27.0-0 to 1.27.0-rc.3 (excl.)

References

Problem Types

  • CWE-407: Inefficient Algorithmic Complexity