CVE-2026-56860: 
cAdvisor Análisis y mitigación de vulnerabilidades

CVE-2026-56860 is a denial-of-service vulnerability in the Go standard library's net/url package caused by quadratic time complexity in relative path resolution. When resolving relative paths containing parent directory (..) segments, the affected code performed string conversions and buffer rewrites on each step, resulting in O(n²) time complexity and excessive memory allocation overhead. Affected versions include net/url before 1.25.13, 1.26.0-0 through 1.26.6, and 1.27.0-0 through 1.27.0-rc.3. It was published on August 13, 2026, with a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-407 (Inefficient Algorithmic Complexity) and CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable code in net/url resolved .. segments in relative paths by performing repeated string conversions and full buffer rewrites at each step, yielding quadratic O(n²) time and memory complexity. An attacker can exploit this by supplying a crafted URL or path with a large number of .. segments, causing the resolver to consume disproportionate CPU and memory resources. The fix replaces the string-based approach with a byte buffer and index-based backtracking, eliminating the quadratic behavior (GitHub Advisory, Go Issue).

Successful exploitation results in a denial-of-service condition affecting availability only — there is no confidentiality or integrity impact. An unauthenticated remote attacker can exhaust CPU and memory resources on any Go application that processes user-supplied URLs or paths using the net/url package, potentially causing service degradation or complete unavailability. Applications that accept and resolve arbitrary relative URLs (e.g., HTTP servers, proxies, or API gateways built in Go) are most at risk (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The NVD SSVC assessment indicates exploitation is "none" and the attack is not automatable, reflecting the high attack complexity (AC:H) rating. The EPSS score is approximately 0.185%, indicating a low near-term exploitation probability. CVE-2026-56860 is not listed in the CISA Known Exploited Vulnerabilities catalog (GitHub Advisory).

1. Identify target: Locate a Go application (version < 1.25.13, 1.26.x < 1.26.6, or 1.27.0-rc.x < 1.27.0-rc.3) that accepts user-supplied URLs or paths and resolves them using the net/url package (e.g., an HTTP server, reverse proxy, or URL normalizer).
2. Craft malicious path: Construct a relative URL or path containing a very large number of .. segments (e.g., ../../../../../../../ repeated hundreds or thousands of times), designed to trigger the quadratic resolution loop.
3. Send crafted request: Submit the malicious path to the target application via an HTTP request, API call, or any input vector that feeds into net/url path resolution.
4. Trigger resource exhaustion: The vulnerable resolver performs O(n²) string operations, consuming excessive CPU cycles and memory allocations proportional to the square of the number of .. segments, causing the service to slow down or crash (GitHub Advisory, Go Issue).

• Network: Repeated HTTP requests containing URLs or paths with an unusually large number of .. segments (e.g., hundreds of ../ sequences in a single request path or query parameter).
• Logs: Application or web server access logs showing requests with abnormally long path strings composed primarily of .. segments; elevated response times or timeouts correlated with such requests.
• Process: Go application processes exhibiting sudden spikes in CPU usage and memory consumption without a corresponding increase in legitimate traffic; out-of-memory (OOM) kills of Go service processes.

Upgrade to a fixed version of the Go toolchain: 1.25.13 or later (for the 1.25.x branch), 1.26.6 or later (for the 1.26.x branch), or 1.27.0-rc.3 or later (for the 1.27.x release candidate branch). No configuration-based workaround is available; upgrading is the only definitive remediation. Organizations using Go-based applications should rebuild and redeploy affected binaries after upgrading the Go toolchain. Red Hat and SUSE have issued advisories and updated packages for their distributions (Red Hat Bugzilla, SUSE Advisory, Red Hat Errata).

The Go team announced the fix via the golang-announce mailing list, and the issue was also disclosed on oss-security. Red Hat, SUSE, and openSUSE have all issued security advisories and updated packages for their respective distributions. The vulnerability was also picked up by the Yocto Project security list and AusCERT, indicating broad downstream awareness in the Linux ecosystem (golang-announce, oss-sec, SUSE Advisory).