CVE-2026-56860CWE-407

CVE-2026-56860

Medium · published August 14, 2026

CVSS v3.1
5.9
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.3th percentile
Weakness
CWE-407 · Inefficient Algorithmic Complexity
Published
2026-08-14T02:17Z
References (4)
EPSS history
Timeline
  • 13 AUG 21:58Z
    Avoid quadratic complexity in resolvePath in net/url
    cvelistv5