Vulnerability GO-2026-6218

Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
August 13, 2026 at 09:43 PM UTC
Avoid quadratic complexity in resolvePath in net/url
<1.25.13
<1.25.13

Summary

Avoid quadratic complexity in resolvePath in net/url

Details

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Impacted packages

Timeline

Published
1 month ago
August 13, 2026 at 09:43 PM UTC
Last Modified
3 days ago
September 25, 2026 at 10:41 AM UTC