CVE-2026-56860
CVE
High
High Impactnet/url: Quadratic Complexity in resolvePath During URL Resolution
Exploitable
This vulnerability is exploitable in typical deployments. Upgrade to the fixed version as soon as possible.
Component
Go standard library (net/url)
Disclosed
Aug 14, 2026
Description
Go’s
net/url package resolved relative paths containing .. segments by
repeatedly converting to and rewriting a string buffer at each step, giving the
algorithm quadratic time complexity and high memory overhead for pathological
inputs. A URL or request path with many .. segments could make URL.Parse and
URL.ResolveReference consume disproportionate CPU and memory. The fix reworks
resolvePath to use index-based backtracking over a byte buffer instead.Version summary
Community Edition
2.13.9
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.9
Enterprise Edition
2.13.7
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.7
Upgrade to the addressed version or later to remediate this vulnerability.