CVE-2026-56860
High
High ImpactThis CVE is exploitable in typical deployments. Upgrade to the fixed version as soon as possible.
Component
Go standard library (net/url)
Disclosed
Aug 14, 2026
net/url package resolved relative paths containing .. segments by
repeatedly converting to and rewriting a string buffer at each step, giving the
algorithm quadratic time complexity and high memory overhead for pathological
inputs. A URL or request path with many .. segments could make URL.Parse and
URL.ResolveReference consume disproportionate CPU and memory. The fix reworks
resolvePath to use index-based backtracking over a byte buffer instead.Community Edition
2.13.9
addresses this CVE
Affected CE versions
>= 2.0, < 2.13.9
Enterprise Edition
2.13.7
addresses this CVE
Affected EE versions
>= 2.0, < 2.13.7
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates