CVE-2026-56860: Avoid quadratic complexity in resolvePath in net/url
Avoid quadratic complexity in resolvePath in net/url
Other sources
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56860?
CVE-2026-56860 has been assigned a risk score of 12, indicating a critical level of severity.
How do I fix CVE-2026-56860?
To fix CVE-2026-56860, update to the latest version of the affected software where the issue is resolved.
What does CVE-2026-56860 affect?
CVE-2026-56860 affects the path resolution mechanisms in the net/url package, impacting how relative paths are processed.
What is the potential impact of CVE-2026-56860?
The potential impact of CVE-2026-56860 includes increased memory usage and slower performance due to quadratic time complexity in path resolution.
When was CVE-2026-56860 published?
CVE-2026-56860 was published on August 13, 2026.