CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url
Attackers can cause denial of service via quadratic complexity in URL path resolution, affecting Go standard library users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56860?
CVE-2026-56860 is a medium-severity denial of service vulnerability in Go standard library net/url, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Weakness: CWE-407
Which versions are affected by CVE-2026-56860?
2 open source packages ship an affected version, including golang and stdlib.
| Package | Affected | Fixed in |
|---|---|---|
golang Bitnami | All versions | 1.25.13, 1.26.6, 1.27.0 |
stdlib Go | All versions | 1.25.13, 1.26.6, 1.27.0-rc.3 |
Linux distribution packages (9)
runc AlmaLinux:9 | All versions | 4:1.4.2-3.el9_8 |
runc Red Hat:enterprise_linux:9::appstream | All versions | 4:1.4.2-3.el9_8 |
runc-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 4:1.4.2-3.el9_8 |
runc-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 4:1.4.2-3.el9_8 |
host-metering Red Hat:rhel_els:7 | All versions | 0:1.4.0-9.el7_9 |
host-metering-debuginfo Red Hat:rhel_els:7 | All versions | 0:1.4.0-9.el7_9 |
host-metering-debugsource Red Hat:rhel_els:7 | All versions | 0:1.4.0-9.el7_9 |
host-metering-selinux Red Hat:rhel_els:7 | All versions | 0:1.4.0-9.el7_9 |
runc Rocky Linux:9 | All versions | 4:1.4.2-3.el9_8 |
How do I fix CVE-2026-56860?
Upgrade golang to a fixed version for your release line: 1.25.13, 1.26.6 or 1.27.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-56860 being exploited?
There is no known exploitation of CVE-2026-56860 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:70191, AZL-96656, AZL-96665, AZL-98706, BELL-CVE-2026-56860, BIT-golang-2026-56860 and 2162 more.