CVE-2026-56860

Published: Aug 13, 2026Modified: Sep 3, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Related CWEs

CWE-407

Inefficient Algorithmic Complexity

An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (4)

https://go.dev/cl/803681

Source: security@golang.org

https://go.dev/issue/80494

Source: security@golang.org

https://groups.google.com/g/golang-announce/c/94pEornpRlI

Source: security@golang.org

https://pkg.go.dev/vuln/GO-2026-6218

Source: security@golang.org

Timeline

No history available yet.