Skip to content
fr Sign in
5.9 Medium

CVE-2026-56860 Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer…

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Affected products and versions

Product Affected versions Fixed in
net/url 1.27 earliest → < 1.27.0-rc.3 1.27.0-rc.3
net/url 1.26 1.26.0-0 → < 1.26.6 1.26.6
net/url 1.25 earliest → < 1.25.13 1.25.13

References

Timeline

  1. Published
  2. Last modified

Other CVEs of net/url

The 5 CVEs of net/url →
CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid URLs 7.5 High CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query 7.5 High CVE-2025-47912 The Parse function permits values other than IPv6 addresses to be included in square brackets within the host… 5.3 Medium CVE-2022-32190 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path Not rated
Track this CVE