PkgSeer

Vulnerability GO-2026-6218

Unknown

3 months ago

Avoid quadratic complexity in resolvePath in net/url

<1.25.13, >=1.26.0-0 <1.26.6, >=1.27.0-0 <1.27.0-rc.3

Summary

Avoid quadratic complexity in resolvePath in net/url

Details

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

HTTP/1 server crash due to MaxBytesReader header race in net/http

<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6859

Distrust compromised intermediate certificates in crypto/x509

<1.26.10, >=1.27.0-0 <1.27.3 GO-2026-6809

Reset context tracking on consecutive template expressions in html/template

<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6599

Recognize yield as regexp preceder keyword in html/template

<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6600

HTTP/2 server memory exhaustion due to Trailer headers in net/http

<1.26.9, >=1.27.0-0 <1.27.2 GO-2026-6603

View all vulnerabilities for these packages

Impacted packages

stdlib

Timeline

Published

3 months ago

Last Modified

6 hours ago