Vulnerability · Published Aug 13, 2026 · Assigned by Go

CVE-2026-56860Avoid quadratic complexity in resolvePath in net/url

Medium 5.9

In plain English

A medium-severity security flaw in net/url from Go standard library. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.5%top 53.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3901+4b80ecd7ALSA-2026:63163
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+3909+6e1c1eb7ALSA-2026:63163
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4023+db236c53ALSA-2026:63163
AlmaLinux:8aardvark-dns2:1.10.1-2.module_el8.10.0+4047+545787c4ALSA-2026:63163
AlmaLinux:10buildah2:1.43.1-6.el10_2ALSA-2026:64777
AlmaLinux:10buildah2:1.43.1-5.el10_2ALSA-2026:63332
AlmaLinux:8buildah2:1.33.14-6.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9buildah2:1.43.3-2.el9_8ALSA-2026:70640
AlmaLinux:10buildah-tests2:1.43.1-6.el10_2ALSA-2026:64777
AlmaLinux:10buildah-tests2:1.43.1-5.el10_2ALSA-2026:63332
AlmaLinux:8buildah-tests2:1.33.14-6.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9buildah-tests2:1.43.3-2.el9_8ALSA-2026:70640
AlmaLinux:8cockpit-podman84.1-1.module_el8.10.0+4102+6c76e544ALSA-2026:63163
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+3970+8445edf6ALSA-2026:63163
AlmaLinux:8conmon3:2.1.10-1.module_el8.10.0+3845+87b84552ALSA-2026:63163
AlmaLinux:8container-selinux2:2.229.0-3.module_el8.10.0+4213+0493256bALSA-2026:63163
AlmaLinux:8containernetworking-plugins1:1.4.0-10.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9containernetworking-plugins1:1.9.0-4.el9_8ALSA-2026:70391
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4089+ce72bbbeALSA-2026:63163
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4068+0e21408fALSA-2026:63163
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4016+efd18bf8ALSA-2026:63163
AlmaLinux:8containers-common2:1-82.module_el8.10.0+4120+03ad4b47ALSA-2026:63163
AlmaLinux:8crit3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:63163
AlmaLinux:8crit3.18-5.module_el8.10.0+4047+545787c4ALSA-2026:63163
AlmaLinux:8crit3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:63163
AlmaLinux:8crit3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:63163
AlmaLinux:8criu3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:63163
AlmaLinux:8criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:63163
AlmaLinux:8criu3.18-5.module_el8.10.0+3876+e55593a8ALSA-2026:63163
AlmaLinux:8criu3.18-5.module_el8.10.0+3845+87b84552ALSA-2026:63163
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4016+efd18bf8ALSA-2026:63163
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4082+f7f0c95eALSA-2026:63163
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4089+ce72bbbeALSA-2026:63163
AlmaLinux:8criu-devel3.18-5.module_el8.10.0+4068+0e21408fALSA-2026:63163
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+4082+f7f0c95eALSA-2026:63163
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3909+6e1c1eb7ALSA-2026:63163
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+3970+8445edf6ALSA-2026:63163
AlmaLinux:8criu-libs3.18-5.module_el8.10.0+4068+0e21408fALSA-2026:63163
AlmaLinux:8crun1.14.3-4.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:8delve1.26.1-1.module_el8.10.0+4223+bd807c2eALSA-2026:60305
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3970+8445edf6ALSA-2026:63163
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4068+0e21408fALSA-2026:63163
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+4082+f7f0c95eALSA-2026:63163
AlmaLinux:8fuse-overlayfs1.13-1.module_el8.10.0+3909+6e1c1eb7ALSA-2026:63163
AlmaLinux:10git-lfs3.7.1-5.el10_2.7ALSA-2026:64788
AlmaLinux:8git-lfs3.4.1-13.el8_10ALSA-2026:67161
AlmaLinux:9git-lfs3.7.1-4.el9_8.3ALSA-2026:66364
AlmaLinux:10go-fdo-client1.0.0-4.el10_2.7ALSA-2026:62577
AlmaLinux:10go-fdo-server1.0.1-2.el10_2.4ALSA-2026:62578
AlmaLinux:10go-fdo-server-manufacturer1.0.1-2.el10_2.4ALSA-2026:62578
AlmaLinux:10go-fdo-server-owner1.0.1-2.el10_2.4ALSA-2026:62578
AlmaLinux:10go-fdo-server-rendezvous1.0.1-2.el10_2.4ALSA-2026:62578
AlmaLinux:10go-toolset1.26.7-1.el10_2.alma.1ALSA-2026:60306
AlmaLinux:8go-toolset1.26.7-1.module_el8.10.0+4264+117c8fc2ALSA-2026:60305
AlmaLinux:9go-toolset1.26.7-1.el9_8ALSA-2026:60304
AlmaLinux:10golang1.26.7-1.el10_2.alma.1ALSA-2026:60306
AlmaLinux:8golang1.26.7-1.module_el8.10.0+4264+117c8fc2ALSA-2026:60305
AlmaLinux:9golang1.26.7-1.el9_8ALSA-2026:60304
AlmaLinux:10golang-bin1.26.7-1.el10_2.alma.1ALSA-2026:60306
AlmaLinux:8golang-bin1.26.7-1.module_el8.10.0+4264+117c8fc2ALSA-2026:60305
AlmaLinux:9golang-bin1.26.7-1.el9_8ALSA-2026:60304
AlmaLinux:10golang-docs1.26.7-1.el10_2.alma.1ALSA-2026:60306
AlmaLinux:8golang-docs1.26.7-1.module_el8.10.0+4264+117c8fc2ALSA-2026:60305
AlmaLinux:9golang-docs1.26.7-1.el9_8ALSA-2026:60304
AlmaLinux:10golang-misc1.26.7-1.el10_2.alma.1ALSA-2026:60306
AlmaLinux:8golang-misc1.26.7-1.module_el8.10.0+4264+117c8fc2ALSA-2026:60305
AlmaLinux:9golang-misc1.26.7-1.el9_8ALSA-2026:60304
AlmaLinux:10golang-race1.26.7-1.el10_2.alma.1ALSA-2026:60306
AlmaLinux:8golang-race1.26.7-1.module_el8.10.0+4264+117c8fc2ALSA-2026:60305
AlmaLinux:9golang-race1.26.7-1.el9_8ALSA-2026:60304
AlmaLinux:10golang-src1.26.7-1.el10_2.alma.1ALSA-2026:60306
AlmaLinux:8golang-src1.26.7-1.module_el8.10.0+4264+117c8fc2ALSA-2026:60305
AlmaLinux:9golang-src1.26.7-1.el9_8ALSA-2026:60304
AlmaLinux:10golang-tests1.26.7-1.el10_2.alma.1ALSA-2026:60306
AlmaLinux:8golang-tests1.26.7-1.module_el8.10.0+4264+117c8fc2ALSA-2026:60305
AlmaLinux:9golang-tests1.26.7-1.el9_8ALSA-2026:60304
AlmaLinux:10grafana10.2.6-28.el10_2.5ALSA-2026:63022
AlmaLinux:8grafana9.2.10-33.el8_10ALSA-2026:62407
AlmaLinux:9grafana10.2.6-23.el9_8.3ALSA-2026:62406
AlmaLinux:10grafana-pcp5.3.0-8.el10_2.1ALSA-2026:63119
AlmaLinux:8grafana-pcp5.1.1-18.el8_10ALSA-2026:63124
AlmaLinux:9grafana-pcp5.1.1-17.el9_8.1ALSA-2026:63136
AlmaLinux:10grafana-selinux10.2.6-28.el10_2.5ALSA-2026:63022
AlmaLinux:8grafana-selinux9.2.10-33.el8_10ALSA-2026:62407
AlmaLinux:9grafana-selinux10.2.6-23.el9_8.3ALSA-2026:62406
AlmaLinux:10ipp-usb0.9.27-7.el10_2.3ALSA-2026:62631
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4090+91932338ALSA-2026:63163
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4120+03ad4b47ALSA-2026:63163
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4068+0e21408fALSA-2026:63163
AlmaLinux:8libslirp4.4.0-2.module_el8.10.0+4016+efd18bf8ALSA-2026:63163
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+3970+8445edf6ALSA-2026:63163
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4068+0e21408fALSA-2026:63163
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4082+f7f0c95eALSA-2026:63163
AlmaLinux:8libslirp-devel4.4.0-2.module_el8.10.0+4102+6c76e544ALSA-2026:63163
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4023+db236c53ALSA-2026:63163
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:63163
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+3926+f12484f5ALSA-2026:63163
AlmaLinux:8netavark2:1.10.3-1.module_el8.10.0+4047+545787c4ALSA-2026:63163
AlmaLinux:8oci-seccomp-bpf-hook1.2.10-3.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:10opentelemetry-collector0.152.1-2.el10_2ALSA-2026:65116
AlmaLinux:9opentelemetry-collector0.152.1-2.el9_8ALSA-2026:65117
AlmaLinux:8osbuild-composer101.5-2.el8_10.alma.1ALSA-2026:66016
AlmaLinux:9osbuild-composer165.1-4.el9_8.1.alma.1ALSA-2026:65153
AlmaLinux:8osbuild-composer-core101.5-2.el8_10.alma.1ALSA-2026:66016
AlmaLinux:9osbuild-composer-core165.1-4.el9_8.1.alma.1ALSA-2026:65153
AlmaLinux:8osbuild-composer-worker101.5-2.el8_10.alma.1ALSA-2026:66016
AlmaLinux:9osbuild-composer-worker165.1-4.el9_8.1.alma.1ALSA-2026:65153
AlmaLinux:10podman7:5.8.2-9.el10_2.alma.1ALSA-2026:70201
AlmaLinux:8podman4:4.9.4-37.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9podman6:5.8.2-7.el9_8ALSA-2026:69961
AlmaLinux:8podman-catatonit4:4.9.4-37.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:10podman-docker7:5.8.2-9.el10_2.alma.1ALSA-2026:70201
AlmaLinux:8podman-docker4:4.9.4-37.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9podman-docker6:5.8.2-7.el9_8ALSA-2026:69961
AlmaLinux:8podman-gvproxy4:4.9.4-37.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:8podman-plugins4:4.9.4-37.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9podman-plugins6:5.8.2-7.el9_8ALSA-2026:69961
AlmaLinux:10podman-remote7:5.8.2-9.el10_2.alma.1ALSA-2026:70201
AlmaLinux:8podman-remote4:4.9.4-37.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9podman-remote6:5.8.2-7.el9_8ALSA-2026:69961
AlmaLinux:10podman-tests7:5.8.2-9.el10_2.alma.1ALSA-2026:70201
AlmaLinux:8podman-tests4:4.9.4-37.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9podman-tests6:5.8.2-7.el9_8ALSA-2026:69961
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+4047+545787c4ALSA-2026:63163
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+4120+03ad4b47ALSA-2026:63163
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3901+4b80ecd7ALSA-2026:63163
AlmaLinux:8python3-criu3.18-5.module_el8.10.0+3858+6ad51f9fALSA-2026:63163
AlmaLinux:8python3-podman4.9.0-3.module_el8.10.0+4016+efd18bf8ALSA-2026:63163
AlmaLinux:8runc4:1.2.9-6.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9runc4:1.4.2-3.el9_8ALSA-2026:70191
AlmaLinux:10skopeo2:1.22.2-5.el10_2ALSA-2026:64818
AlmaLinux:8skopeo2:1.14.6-4.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9skopeo2:1.22.2-8.el9_8ALSA-2026:70641
AlmaLinux:10skopeo-tests2:1.22.2-5.el10_2ALSA-2026:64818
AlmaLinux:8skopeo-tests2:1.14.6-4.module_el8.10.0+4269+94686149ALSA-2026:63163
AlmaLinux:9skopeo-tests2:1.22.2-8.el9_8ALSA-2026:70641
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+3901+4b80ecd7ALSA-2026:63163
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4082+f7f0c95eALSA-2026:63163
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4023+db236c53ALSA-2026:63163
AlmaLinux:8slirp4netns1.2.3-1.module_el8.10.0+4047+545787c4ALSA-2026:63163
AlmaLinux:8toolbox0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:63163
AlmaLinux:8toolbox-tests0.0.99.5.1-1.module_el8.10.0+4120+03ad4b47ALSA-2026:63163
AlmaLinux:8udica0.2.6-21.module_el8.10.0+4068+0e21408fALSA-2026:63163
AlmaLinux:10yggdrasil0.4.9.2-1.el10_2.3ALSA-2026:69308
AlmaLinux:10yggdrasil-devel0.4.9.2-1.el10_2.3ALSA-2026:69308
AlmaLinux:10yggdrasil-worker-package-manager0.2.3-7.el10_2.8ALSA-2026:69099
Alpine:v3.24go1.26.8-r0ALPINE-CVE-2026-56860
Debian:12golang-1.19no fix listedDEBIAN-CVE-2026-56860
Debian:13golang-1.24no fix listedDEBIAN-CVE-2026-56860
Debian:14golang-1.261.26.6-1DEBIAN-CVE-2026-56860
Debian:14golang-1.271.27~rc3-1DEBIAN-CVE-2026-56860
Gostdlib1.25.13, 1.26.6, 1.27.0-rc.3GO-2026-6218
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+40047+0c0a73f4RLSA-2026:63163
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1896+b18fa106RLSA-2026:63163
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1874+ce489889RLSA-2026:63163
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+40133+32c21f88RLSA-2026:63163
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+2001+6a33db9fRLSA-2026:63163
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1948+4b5cd4a9RLSA-2026:63163
Rocky Linux:8aardvark-dns2:1.10.1-2.module+el8.10.0+1880+8e896d1bRLSA-2026:63163
Rocky Linux:10buildah2:1.43.1-6.el10_2RLSA-2026:64777
Rocky Linux:10buildah2:1.43.1-5.el10_2RLSA-2026:63332
Rocky Linux:9buildah2:1.43.3-2.el9_8RLSA-2026:70640
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1815+5fe7415eRLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1896+b18fa106RLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1872+2e18eb19RLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1874+ce489889RLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+40133+32c21f88RLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1880+8e896d1bRLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1825+623b0c20RLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+2001+6a33db9fRLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+1843+6892ab28RLSA-2026:63163
Rocky Linux:8cockpit-podman0:84.1-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1874+ce489889RLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1872+2e18eb19RLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9RLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1843+6892ab28RLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1880+8e896d1bRLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1896+b18fa106RLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+40133+32c21f88RLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+1815+5fe7415eRLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+40047+0c0a73f4RLSA-2026:63163
Rocky Linux:8conmon3:2.1.10-1.module+el8.10.0+2001+6a33db9fRLSA-2026:63163
Rocky Linux:8container-selinux2:2.229.0-3.module+el8.10.0+40223+e940a224RLSA-2026:63163
Rocky Linux:9containernetworking-plugins1:1.9.0-4.el9_8RLSA-2026:70391
Rocky Linux:8containers-common2:1-82.module+el8.10.0+40047+0c0a73f4RLSA-2026:63163
Rocky Linux:8containers-common2:1-82.module+el8.10.0+40133+32c21f88RLSA-2026:63163
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1948+4b5cd4a9RLSA-2026:63163
Rocky Linux:8containers-common2:1-82.module+el8.10.0+2001+6a33db9fRLSA-2026:63163
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1843+6892ab28RLSA-2026:63163
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1872+2e18eb19RLSA-2026:63163
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1874+ce489889RLSA-2026:63163
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1880+8e896d1bRLSA-2026:63163
Rocky Linux:8containers-common2:1-82.module+el8.10.0+1896+b18fa106RLSA-2026:63163
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1815+5fe7415eRLSA-2026:63163
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1874+ce489889RLSA-2026:63163
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1896+b18fa106RLSA-2026:63163
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1948+4b5cd4a9RLSA-2026:63163
Rocky Linux:8criu0:3.18-5.module+el8.10.0+1872+2e18eb19RLSA-2026:63163
Rocky Linux:8criu0:3.18-5.module+el8.10.0+40047+0c0a73f4RLSA-2026:63163

Affected products (as reported)

VendorProductVersions
Go standard library net/url 0 – before 1.25.131.26.0-0 – before 1.26.61.27.0-0 – before 1.27.0-rc.3

Weakness: CWE-407 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References