5.9
Moyenne
CVE-2026-56860 Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer…
Description
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Produits et versions touchés
Autres CVE de net/url
Les 5 CVE de net/url →
CVE-2026-25679
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs
7.5
Élevée
CVE-2025-61726
The net/url package does not set a limit on the number of query parameters in a query
7.5
Élevée
CVE-2025-47912
The Parse function permits values other than IPv6 addresses to be included in square brackets within the host…
5.3
Moyenne
CVE-2022-32190
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path
Non notée