{"id":"CVE-2022-32190","aliases":["GO-2022-0988","BIT-golang-2022-32190"],"title":"Failure to strip relative path components in net/url","summary":"Failure to strip relative path components in net/url","severity":"none","vendor":"stdlib","product":"stdlib","ecosystem":"go","affected":["stdlib >= 1.19.0-0, < 1.19.1"],"patched":["stdlib 1.19.1"],"published":"2022-09-12","updated":"2026-07-15","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2022-0988","references":[{"url":"https://groups.google.com/g/golang-announce/c/x49AQzIVX-s"},{"url":"https://go.dev/issue/54385"},{"url":"https://go.dev/cl/423514"}],"tags":["osv","go"],"epss":0.02152,"epssPercentile":0.81093,"ingestedAt":"2026-07-16T18:59:42.653Z","slug":"CVE-2022-32190","body":"## Overview\n\nJoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath(\"https://go.dev\", \"../go\") returns the URL \"https://go.dev/../go\", despite the JoinPath documentation stating that ../ path elements are removed from the result.\n\n## Affected packages\n\n- `stdlib >= 1.19.0-0, < 1.19.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stdlib 1.19.1`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}