---
id: CVE-2022-32190
aliases:
  - GO-2022-0988
  - BIT-golang-2022-32190
title: Failure to strip relative path components in net/url
summary: Failure to strip relative path components in net/url
severity: none
vendor: stdlib
product: stdlib
ecosystem: go
affected:
  - 'stdlib >= 1.19.0-0, < 1.19.1'
patched:
  - stdlib 1.19.1
published: '2022-09-12'
updated: '2026-07-15'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2022-0988'
references:
  - url: 'https://groups.google.com/g/golang-announce/c/x49AQzIVX-s'
  - url: 'https://go.dev/issue/54385'
  - url: 'https://go.dev/cl/423514'
tags:
  - osv
  - go
epss: 0.02152
epssPercentile: 0.81345
ingestedAt: '2026-07-16T18:59:42.653Z'
---

## Overview

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.

## Affected packages

- `stdlib >= 1.19.0-0, < 1.19.1`

## Remediation

Upgrade to a patched release:

- `stdlib 1.19.1`