ZeroDay Findings
Sign inSign up

Findings

CVE-2026-56860

Avoid quadratic complexity in resolvePath in net/url

Published Aug 13, 2026 · updated Oct 15, 2026

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 13, 2026 · Catalog

    Detected

    Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocat

  2. Oct 10, 2026 · Catalog

    Fix available

    Go stdlib 0 → 1.25.13

  3. Oct 10, 2026 · OSV.dev

    Fix available

    stdlib fixed in 1.25.13

  4. Oct 10, 2026 · OSV.dev

    Fix available

    stdlib fixed in 1.25.13

  5. Oct 10, 2026 · Catalog

    Updated

    Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocat

  6. Oct 15, 2026 · OSV.dev

    Updated

    Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocat

Affected

  • Go stdlib0 → 1.25.13

Sources

  • CVE.orgVulnerability recordCVE-2026-56860

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-56860

    30-day exploitation probability 0.5%

    first.org
  • OSV.devPackage advisoryGO-2026-6218

    Avoid quadratic complexity in resolvePath in net/url

    osv.dev

References