CVE-2026-56860: 
Go 脆弱性の分析と軽減

CVE-2026-56860 is a denial-of-service vulnerability in the Go standard library's net/url package caused by quadratic time complexity during relative path resolution. When resolving paths containing parent directory (..) segments, the implementation performed string conversions and buffer rewrites on each step, leading to excessive CPU and memory consumption. Affected versions include Go net/url before 1.25.13, 1.26.0–1.26.5, and 1.27.0-rc.0 through 1.27.0-rc.2. It was published on August 13, 2026, with a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-407 (Inefficient Algorithmic Complexity) and CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable code path in net/url resolved relative URL paths by iterating over .. segments and performing string conversions and full buffer rewrites at each step, resulting in O(n²) time and memory complexity relative to the number of path segments. An attacker can craft a URL with a large number of .. segments and submit it to any Go application that processes user-supplied URLs via net/url, triggering resource exhaustion. The fix replaces the string-based approach with index-based backtracking on a byte buffer, eliminating the quadratic behavior (GitHub Advisory, Go Issue, Go CL).

Successful exploitation causes denial of service by exhausting CPU and memory resources on the affected server, potentially rendering the application or service unavailable. The impact is limited to availability — there is no confidentiality or integrity impact. Any Go application that processes attacker-controlled URLs using the standard library's net/url package is at risk, which includes a broad range of web services, proxies, and API servers built with Go (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The NVD SSVC assessment rates exploitation as "none" and the attack as non-automatable due to high attack complexity. The EPSS score is approximately 0.185%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Identify target: Locate a Go-based web service or API that accepts user-supplied URLs or URL path components and processes them using the net/url standard library (versions before 1.25.13, 1.26.6, or 1.27.0-rc.3).
2. Craft malicious URL: Construct a URL containing a very large number of .. path segments (e.g., http://example.com/a/../a/../a/../... repeated thousands of times) to maximize the quadratic processing overhead.
3. Submit request: Send the crafted URL to the target application endpoint via HTTP or another supported protocol. No authentication is required if the endpoint is publicly accessible.
4. Trigger resource exhaustion: The server's net/url path resolution processes each .. segment with O(n²) complexity, consuming excessive CPU cycles and memory, leading to service degradation or crash (GitHub Advisory, Go Issue).

• Network: Repeated HTTP requests to application endpoints containing URLs with an unusually large number of .. path segments; high request rates from a single source IP targeting URL-processing endpoints.
• Logs: Application or web server logs showing requests with abnormally long URL paths composed of many .. segments; timeout or out-of-memory errors in Go application logs coinciding with such requests.
• Process: Sudden spikes in CPU and memory usage by the Go application process without a corresponding increase in legitimate traffic; Go runtime out-of-memory (OOM) kills or process restarts.

Upgrade to Go 1.25.13, 1.26.6, or 1.27.0-rc.3 or later, which replace the quadratic path resolution algorithm with an efficient index-based byte buffer approach. Red Hat has issued patches for RHEL 8 (RHSA-2026:60305), RHEL 9 (RHSA-2026:60304), and RHEL 10 (RHSA-2026:60306). SUSE has released updates (SUSE-SU-2026:3640-1, SUSE-SU-2026:3799-1, SUSE-SU-2026:3815-1, SUSE-SU-2026:3830-1). As a workaround where patching is not immediately possible, consider validating and rejecting user-supplied URLs with excessive path depth before passing them to net/url (Red Hat Bugzilla, GitHub Advisory).

The Go team announced the fix via the golang-announce mailing list and the vulnerability was discussed on oss-security. A Mastodon post from user @lambdawatchdog noted the issue. Coverage has been limited to routine security advisory aggregation by vendors such as Red Hat, SUSE, openSUSE, and security news outlets like pro-linux.de (golang-announce, oss-sec).