Medium severity · published Aug 13, 2026
CVE-2026-56860
Avoid quadratic complexity in resolvePath in net/url
5.9
CVSS
0.5%
EPSS
No
On KEV
Description
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
net/url · Go standard library
before 1.25.13; 1.26.0-0 before 1.26.6; 1.27.0-0 before 1.27.0-rc.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-56860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-56860
go.dev
https://go.dev/cl/803681
go.dev
https://go.dev/issue/80494
groups.google.com
https://groups.google.com/g/golang-announce/c/94pEornpRlI
pkg.go.dev
https://pkg.go.dev/vuln/GO-2026-6218
More from net/url
7.5
CVE-2026-25679
Incorrect parsing of IPv6 host literals in net/url
7.5
CVE-2025-61726
Memory exhaustion in query parameter parsing in net/url
5.3
CVE-2025-47912
Insufficient validation of bracketed IPv6 hostnames in net/url
