CVE-2026-56860: 
Golang vulnerability analysis and mitigation

CVE-2026-56860 is a denial-of-service vulnerability in the Go standard library's net/url package caused by inefficient algorithmic complexity (CWE-407) in relative path resolution. When resolving relative paths containing parent directory (..) segments, the implementation performed string conversions and buffer rewrites at each step, resulting in quadratic time complexity and excessive memory allocation. Affected versions include Go net/url before 1.25.13, 1.26.0–1.26.6, and 1.27.0-rc.0 through 1.27.0-rc.2. The vulnerability was published on August 13, 2026, with a patch advisory released August 14, 2026. No official CVSS base score has been assigned (listed as 0.0), though Feedly estimates severity as HIGH (GitHub Advisory, OSV).

The root cause is CWE-407 (Inefficient Algorithmic Complexity): the net/url path resolution logic for .. segments iteratively performed string conversions and full buffer rewrites, yielding O(n²) time complexity relative to the number of .. segments in a crafted path. An attacker can supply a URL or path with a large number of .. segments to trigger disproportionate CPU and memory consumption. The fix replaces the string-based approach with a byte buffer and index-based backtracking, reducing complexity to linear. The issue is tracked upstream at Go Issue #80494 and addressed in changelist CL 803681 (GitHub Advisory, Go Vuln DB).

Successful exploitation allows an attacker to exhaust CPU and memory resources on any Go application that processes attacker-controlled URLs or paths using the net/url package, leading to service degradation or complete denial of service. Because net/url is part of the Go standard library, the blast radius is broad — any Go-based web server, proxy, or API service that parses user-supplied URLs without sanitization is potentially affected. There is no known confidentiality or integrity impact; the vulnerability is limited to availability (GitHub Advisory, OSV).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The EPSS score is 0.0, indicating very low current probability of exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only the ability to supply a crafted URL or path to a vulnerable Go application, making it low-complexity but dependent on application exposure (GitHub Advisory, Go Announce).

1. Identify target: Locate a Go application (web server, API, proxy) that accepts user-supplied URLs or paths and processes them using the net/url package on a vulnerable Go version (< 1.25.13, 1.26.0–1.26.6, or 1.27.0-rc.0 to 1.27.0-rc.2).
2. Craft malicious path: Construct a URL or path string containing a large number of .. segments (e.g., /../../../../../../../ repeated thousands of times) to maximize the quadratic blowup in processing time.
3. Submit crafted input: Send the crafted URL/path to the target application via HTTP request, form input, or any other input vector that triggers net/url path resolution.
4. Trigger resource exhaustion: The server's net/url path resolution enters quadratic-time processing, consuming excessive CPU cycles and memory, causing the service to slow significantly or crash (denial of service) (Go Issue, Go Vuln DB).

• Network: Repeated HTTP requests containing URLs with abnormally long sequences of .. path segments targeting Go-based services.
• Logs: Application logs showing sudden spikes in request processing latency or timeouts for URL-parsing operations; out-of-memory (OOM) errors or process crashes in Go application logs.
• Process: Unusual sustained high CPU or memory usage by Go application processes coinciding with incoming requests containing deeply nested relative paths.

Upgrade to a patched version of Go: 1.25.13 or later (for the 1.25.x branch), 1.26.6 or later (for the 1.26.x branch), or 1.27.0-rc.3 or later (for the 1.27.x release candidate branch). No configuration-based workaround is documented; upgrading the Go toolchain and recompiling affected applications is the recommended remediation. As an interim measure, applications can validate and reject input URLs containing excessive .. segments before passing them to net/url (Go Announce, Go Vuln DB, GitHub Advisory).

The Go team disclosed the vulnerability via the golang-announce mailing list and the Go vulnerability database. The issue was also discussed on oss-security mailing lists shortly after disclosure. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability aggregator coverage (Go Announce, oss-sec).