{"id":"CVE-2026-56860","aliases":["GO-2026-6218","BIT-golang-2026-56860"],"title":"Avoid quadratic complexity in resolvePath in net/url","summary":"Avoid quadratic complexity in resolvePath in net/url","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","vendor":"stdlib","product":"stdlib","ecosystem":"go","affected":["stdlib >= 1.27.0-0, < 1.27.0-rc.3"],"patched":["stdlib 1.27.0-rc.3"],"published":"2026-08-13","updated":"2026-09-21","sourceUpdated":"2026-09-21T10:56:39.333700188Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6218","references":[{"url":"https://go.dev/cl/803681"},{"url":"https://go.dev/issue/80494"},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56860.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860"},{"url":"https://pkg.go.dev/vuln/GO-2026-6218"},{"url":"https://access.redhat.com/errata/RHSA-2026:68334"},{"url":"https://access.redhat.com/errata/RHSA-2026:68335"},{"url":"https://access.redhat.com/errata/RHSA-2026:66350"},{"url":"https://access.redhat.com/errata/RHSA-2026:66375"},{"url":"https://access.redhat.com/errata/RHSA-2026:66356"},{"url":"https://access.redhat.com/errata/RHSA-2026:68333"},{"url":"https://access.redhat.com/errata/RHSA-2026:65918"},{"url":"https://access.redhat.com/errata/RHSA-2026:67149"},{"url":"https://access.redhat.com/errata/RHSA-2026:61882"},{"url":"https://access.redhat.com/errata/RHSA-2026:67517"},{"url":"https://access.redhat.com/errata/RHSA-2026:66459"},{"url":"https://access.redhat.com/errata/RHSA-2026:65335"},{"url":"https://access.redhat.com/errata/RHSA-2026:67974"},{"url":"https://access.redhat.com/errata/RHSA-2026:66327"},{"url":"https://access.redhat.com/errata/RHSA-2026:63332"},{"url":"https://access.redhat.com/errata/RHSA-2026:64777"},{"url":"https://access.redhat.com/errata/RHSA-2026:64788"},{"url":"https://access.redhat.com/errata/RHSA-2026:62577"},{"url":"https://access.redhat.com/errata/RHSA-2026:62578"},{"url":"https://access.redhat.com/errata/RHSA-2026:60306"},{"url":"https://access.redhat.com/errata/RHSA-2026:63022"},{"url":"https://access.redhat.com/errata/RHSA-2026:63119"},{"url":"https://access.redhat.com/errata/RHSA-2026:65534"},{"url":"https://access.redhat.com/errata/RHSA-2026:62631"},{"url":"https://access.redhat.com/errata/RHSA-2026:65116"},{"url":"https://access.redhat.com/errata/RHSA-2026:65895"},{"url":"https://access.redhat.com/errata/RHSA-2026:63127"},{"url":"https://access.redhat.com/errata/RHSA-2026:64818"},{"url":"https://access.redhat.com/errata/RHSA-2026:63163"},{"url":"https://access.redhat.com/errata/RHSA-2026:60305"},{"url":"https://access.redhat.com/errata/RHSA-2026:62407"},{"url":"https://access.redhat.com/errata/RHSA-2026:63124"},{"url":"https://access.redhat.com/errata/RHSA-2026:64786"},{"url":"https://access.redhat.com/errata/RHSA-2026:62602"}],"tags":["osv","go","csaf","vex","red-hat"],"epss":0.00518,"epssPercentile":0.42874,"cvssSource":"vendor","cwe":["CWE-770"],"ingestedAt":"2026-08-14T19:18:46.729Z","slug":"CVE-2026-56860","body":"## Overview\n\nPreviously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.\n\nNow, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.\n\n## Affected packages\n\n- `stdlib >= 1.27.0-0, < 1.27.0-rc.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `stdlib 1.27.0-rc.3`\n\n## Vendor advisories\n\n- **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334)\n- **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335)\n- **RHSA-2026:66350** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.21 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66350)\n- **RHSA-2026:66375** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.20 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66375)\n- **RHSA-2026:66356** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.22 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:66356)\n- **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333)\n- **RHSA-2026:65918** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:65918)\n- **RHSA-2026:67149** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67149)\n- **RHSA-2026:61882** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:61882)\n- **RHSA-2026:67517** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67517)\n- **RHSA-2026:66459** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66459)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, AWS Load Balancer Operator, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Compliance Operator, Confidential Compute Attestation, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 10, … · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56860.json)\n- **RHSA-2026:65335** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65335)\n- **RHSA-2026:66327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66327)\n- **RHSA-2026:63332** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:63332)\n- **RHSA-2026:64777** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64777)\n- **RHSA-2026:64788** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:64788)\n- **RHSA-2026:62577** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62577)\n- **RHSA-2026:62578** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62578)\n- **RHSA-2026:60306** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60306)\n- **RHSA-2026:63022** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63022)\n- **RHSA-2026:63119** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63119)\n- **RHSA-2026:65534** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65534)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":201801,"id":"CVE-2026-56860","ts":1789399725889,"field":"cvss","old":null,"new":"7.5"},{"seq":201800,"id":"CVE-2026-56860","ts":1789399725889,"field":"severity","old":"none","new":"high"},{"seq":200531,"id":"CVE-2026-56860","ts":1789397373823,"field":"cvss","old":"7.5","new":null},{"seq":200530,"id":"CVE-2026-56860","ts":1789397373823,"field":"severity","old":"high","new":"none"},{"seq":198448,"id":"CVE-2026-56860","ts":1789391968835,"field":"cvss","old":null,"new":"7.5"},{"seq":198447,"id":"CVE-2026-56860","ts":1789391968835,"field":"severity","old":"none","new":"high"},{"seq":196241,"id":"CVE-2026-56860","ts":1789383585240,"field":"cvss","old":"7.5","new":null},{"seq":196240,"id":"CVE-2026-56860","ts":1789383585240,"field":"severity","old":"high","new":"none"},{"seq":195170,"id":"CVE-2026-56860","ts":1789380475083,"field":"cvss","old":null,"new":"7.5"},{"seq":195169,"id":"CVE-2026-56860","ts":1789380475083,"field":"severity","old":"none","new":"high"},{"seq":193957,"id":"CVE-2026-56860","ts":1789378516145,"field":"cvss","old":"7.5","new":null},{"seq":193956,"id":"CVE-2026-56860","ts":1789378516145,"field":"severity","old":"high","new":"none"},{"seq":192744,"id":"CVE-2026-56860","ts":1789376407178,"field":"cvss","old":null,"new":"7.5"},{"seq":192743,"id":"CVE-2026-56860","ts":1789376407178,"field":"severity","old":"none","new":"high"},{"seq":191531,"id":"CVE-2026-56860","ts":1789373419728,"field":"cvss","old":"7.5","new":null},{"seq":191530,"id":"CVE-2026-56860","ts":1789373419728,"field":"severity","old":"high","new":"none"},{"seq":190316,"id":"CVE-2026-56860","ts":1789369300043,"field":"cvss","old":null,"new":"7.5"},{"seq":190315,"id":"CVE-2026-56860","ts":1789369300043,"field":"severity","old":"none","new":"high"},{"seq":189103,"id":"CVE-2026-56860","ts":1789368267019,"field":"cvss","old":"7.5","new":null},{"seq":189102,"id":"CVE-2026-56860","ts":1789368267019,"field":"severity","old":"high","new":"none"},{"seq":187886,"id":"CVE-2026-56860","ts":1789365143384,"field":"cvss","old":null,"new":"7.5"},{"seq":187885,"id":"CVE-2026-56860","ts":1789365143384,"field":"severity","old":"none","new":"high"},{"seq":186673,"id":"CVE-2026-56860","ts":1789363271440,"field":"cvss","old":"7.5","new":null},{"seq":186672,"id":"CVE-2026-56860","ts":1789363271440,"field":"severity","old":"high","new":"none"},{"seq":185459,"id":"CVE-2026-56860","ts":1789361101367,"field":"cvss","old":null,"new":"7.5"},{"seq":185458,"id":"CVE-2026-56860","ts":1789361101367,"field":"severity","old":"none","new":"high"},{"seq":184246,"id":"CVE-2026-56860","ts":1789358155699,"field":"cvss","old":"7.5","new":null},{"seq":184245,"id":"CVE-2026-56860","ts":1789358155699,"field":"severity","old":"high","new":"none"},{"seq":182497,"id":"CVE-2026-56860","ts":1789354222502,"field":"cvss","old":null,"new":"7.5"},{"seq":182496,"id":"CVE-2026-56860","ts":1789354222502,"field":"severity","old":"none","new":"high"},{"seq":181290,"id":"CVE-2026-56860","ts":1789353120643,"field":"cvss","old":"7.5","new":null},{"seq":181289,"id":"CVE-2026-56860","ts":1789353120643,"field":"severity","old":"high","new":"none"},{"seq":180083,"id":"CVE-2026-56860","ts":1789350169156,"field":"cvss","old":null,"new":"7.5"},{"seq":180082,"id":"CVE-2026-56860","ts":1789350169156,"field":"severity","old":"none","new":"high"},{"seq":178876,"id":"CVE-2026-56860","ts":1789348101470,"field":"cvss","old":"7.5","new":null},{"seq":178875,"id":"CVE-2026-56860","ts":1789348101470,"field":"severity","old":"high","new":"none"},{"seq":177669,"id":"CVE-2026-56860","ts":1789346277653,"field":"cvss","old":null,"new":"7.5"},{"seq":177668,"id":"CVE-2026-56860","ts":1789346277653,"field":"severity","old":"none","new":"high"},{"seq":176462,"id":"CVE-2026-56860","ts":1789343018811,"field":"cvss","old":"7.5","new":null},{"seq":176461,"id":"CVE-2026-56860","ts":1789343018811,"field":"severity","old":"high","new":"none"},{"seq":174579,"id":"CVE-2026-56860","ts":1789334771648,"field":"cvss","old":null,"new":"7.5"},{"seq":174578,"id":"CVE-2026-56860","ts":1789334771648,"field":"severity","old":"none","new":"high"},{"seq":173374,"id":"CVE-2026-56860","ts":1789333513050,"field":"cvss","old":"7.5","new":null},{"seq":173373,"id":"CVE-2026-56860","ts":1789333513050,"field":"severity","old":"high","new":"none"},{"seq":172188,"id":"CVE-2026-56860","ts":1789331018079,"field":"cvss","old":null,"new":"7.5"},{"seq":172187,"id":"CVE-2026-56860","ts":1789331018079,"field":"severity","old":"none","new":"high"},{"seq":171002,"id":"CVE-2026-56860","ts":1789328614631,"field":"cvss","old":"7.5","new":null},{"seq":171001,"id":"CVE-2026-56860","ts":1789328614631,"field":"severity","old":"high","new":"none"},{"seq":169797,"id":"CVE-2026-56860","ts":1789327051030,"field":"cvss","old":null,"new":"7.5"},{"seq":169796,"id":"CVE-2026-56860","ts":1789327051030,"field":"severity","old":"none","new":"high"}]}