{"api_version":"1","generated_at":"2026-09-13T05:03:14+00:00","cve":"CVE-2026-56860","urls":{"html":"https://cve.report/CVE-2026-56860","api":"https://cve.report/api/cve/CVE-2026-56860.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-56860","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860"},"summary":{"title":"Avoid quadratic complexity in resolvePath in net/url","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.","state":"PUBLISHED","assigner":"Go","published_at":"2026-08-13 22:17:22","updated_at":"2026-09-03 16:37:52"},"problem_types":["CWE-407","CWE-407: Inefficient Algorithmic Complexity","CWE-407 CWE-407 Inefficient Algorithmic Complexity"],"metrics":[{"version":"3.1","source":"ADP","type":"DECLARED","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},{"version":"3.1","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","score":"5.9","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","name":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","refsource":"security@golang.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://go.dev/cl/803681","name":"https://go.dev/cl/803681","refsource":"security@golang.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://go.dev/issue/80494","name":"https://go.dev/issue/80494","refsource":"security@golang.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","name":"https://pkg.go.dev/vuln/GO-2026-6218","refsource":"security@golang.org","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Go standard library","product":"net/url","version":"affected 1.25.13 semver","platforms":[]},{"source":"CNA","vendor":"Go standard library","product":"net/url","version":"affected 1.26.0-0 1.26.6 semver","platforms":[]},{"source":"CNA","vendor":"Go standard library","product":"net/url","version":"affected 1.27.0-0 1.27.0-rc.3 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"56860","cve":"CVE-2026-56860","epss":"0.005180000","percentile":"0.421950000","score_date":"2026-09-07","updated_at":"2026-09-08 00:05:28"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},{"other":{"content":{"id":"CVE-2026-56860","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-14T16:14:34.601382Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-407","description":"CWE-407 Inefficient Algorithmic Complexity","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-14T16:14:39.166Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://pkg.go.dev","defaultStatus":"unaffected","packageName":"net/url","product":"net/url","programRoutines":[{"name":"resolvePath"},{"name":"URL.Parse"},{"name":"URL.ResolveReference"}],"vendor":"Go standard library","versions":[{"lessThan":"1.25.13","status":"affected","version":"0","versionType":"semver"},{"lessThan":"1.26.6","status":"affected","version":"1.26.0-0","versionType":"semver"},{"lessThan":"1.27.0-rc.3","status":"affected","version":"1.27.0-0","versionType":"semver"}]}],"descriptions":[{"lang":"en","value":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."}],"problemTypes":[{"descriptions":[{"description":"CWE-407: Inefficient Algorithmic Complexity","lang":"en"}]}],"providerMetadata":{"dateUpdated":"2026-08-13T21:58:53.731Z","orgId":"1bb62c36-49e3-4200-9d77-64a1400537cc","shortName":"Go"},"references":[{"url":"https://go.dev/cl/803681"},{"url":"https://go.dev/issue/80494"},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI"},{"url":"https://pkg.go.dev/vuln/GO-2026-6218"}],"title":"Avoid quadratic complexity in resolvePath in net/url"}},"cveMetadata":{"assignerOrgId":"1bb62c36-49e3-4200-9d77-64a1400537cc","assignerShortName":"Go","cveId":"CVE-2026-56860","datePublished":"2026-08-13T21:58:53.731Z","dateReserved":"2026-06-23T15:10:49.353Z","dateUpdated":"2026-08-14T16:14:39.166Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-13 22:17:22","lastModifiedDate":"2026-09-03 16:37:52","problem_types":["CWE-407","CWE-407: Inefficient Algorithmic Complexity","CWE-407 CWE-407 Inefficient Algorithmic Complexity"],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-14T16:14:34.601382Z","id":"CVE-2026-56860","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"56860","Ordinal":"1","Title":"Avoid quadratic complexity in resolvePath in net/url","CVE":"CVE-2026-56860","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"56860","Ordinal":"1","NoteData":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.","Type":"Description","Title":"Avoid quadratic complexity in resolvePath in net/url"}]}}}