Aller au contenu
en Se connecter
5.9 Moyenne

CVE-2026-56860 Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer…

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Produits et versions touchés

Produit Versions touchées Corrigé en
net/url 1.27 premières → < 1.27.0-rc.3 1.27.0-rc.3
net/url 1.26 1.26.0-0 → < 1.26.6 1.26.6
net/url 1.25 premières → < 1.25.13 1.25.13

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de net/url

Les 5 CVE de net/url →
CVE-2026-25679 url.Parse insufficiently validated the host/authority component and accepted some invalid URLs 7.5 Élevée CVE-2025-61726 The net/url package does not set a limit on the number of query parameters in a query 7.5 Élevée CVE-2025-47912 The Parse function permits values other than IPv6 addresses to be included in square brackets within the host… 5.3 Moyenne CVE-2022-32190 JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path Non notée
Suivre cette CVE