CVE-2026-56860

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

References

https://pkg.go.dev/vuln/GO-2026-6218

https://groups.google.com/g/golang-announce/c/94pEornpRlI

https://go.dev/issue/80494

https://go.dev/cl/803681

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-58515

Details

Source: Mitre, NVD

Named Vulnerability: GO-2026-6218Named Vulnerability: GHSA-25mv-j2qr-v5jq

Risk Information

CVSS v2

CVSS v3

EPSS