Vulnerability GO-2026-6218
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
August 13, 2026 at 09:43 PM UTC
Avoid quadratic complexity in resolvePath in net/url
<1.25.13
<1.25.13
Summary
Avoid quadratic complexity in resolvePath in net/url
Details
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Enforce maximum recursion depth in encoding/asn1
<1.25.13 GO-2026-5972
<1.25.13 GO-2026-5972
Unknown
1 month ago
Add recursion depth guard during decode in encoding/xml
<1.25.13 GO-2026-6088
<1.25.13 GO-2026-6088
Unknown
1 month ago
Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http
<1.25.13 GO-2026-6089
<1.25.13 GO-2026-6089
Unknown
1 month ago
Limit handshake messages we are willing to accept post-handshake in crypto/tls
<1.25.13 GO-2026-6090
<1.25.13 GO-2026-6090
Unknown
1 month ago
Fix Javascript regexp context tracking in html/template
<1.25.13 GO-2026-6091
<1.25.13 GO-2026-6091
Impacted packages
Timeline
Published
1 month ago
August 13, 2026 at 09:43 PM UTC
Last Modified
3 days ago
September 25, 2026 at 10:41 AM UTC