High [CVE-2026-56860] golang net/url: Denial of Service from quadratic complexity in path resolution
This high-severity Red Hat Linux advisory covers CVE-2026-56860 affecting Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.
Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. A flaw was found in `net/url`, a component of `golang`.
A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.
This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments ('..') may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution.
This can lead to a denial of service, impacting the availability of affected services. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-770.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
- golang-0:1.26.7-1.el10_2
- go-fdo-client-0:1.0.0-4.el10_2.7
- go-fdo-server-0:1.0.1-2.el10_2.4
- golang-github-openprinting-ipp-usb-0:0.9.27-7.el10_2.3
- grafana-0:10.2.6-28.el10_2.5
- grafana-pcp-0:5.3.0-8.el10_2.1
- rhc-1:0.3.8-7.el10_2
- buildah-2:1.43.1-5.el10_2
- buildah-2:1.43.1-6.el10_2
- git-lfs-0:3.7.1-5.el10_2.7
- skopeo-2:1.22.2-5.el10_2
- opentelemetry-collector-0:0.152.1-2.el10_2
- image-builder-0:52.1-1.el10_2.2
- osbuild-composer-0:165.1-3.el10_2.2
- golang-0:1.26.7-1.el10_0
- ignition-0:2.21.0-3.el10_0.4
- delve-0:1.26.1-2.el10_0
- osbuild-composer-0:134.1-12.el10_0
- grafana-pcp-0:5.3.0-1.el10_0.1
- go-toolset:rhel8-8100020260824145918.a3795dee
- grafana-0:9.2.10-33.el8_10
- grafana-pcp-0:5.1.1-18.el8_10
- container-tools:rhel8-8100020260901110702.afee755d
- rhc-1:0.2.5-10.el8_10
- osbuild-composer-0:101.5-2.el8_10
- golang-0:1.26.7-1.el9_8
- grafana-0:10.2.6-23.el9_8.3
- rhc-1:0.2.7-11.el9_8
- grafana-pcp-0:5.1.1-17.el9_8.1
- opentelemetry-collector-0:0.152.1-2.el9_8
- osbuild-composer-0:165.1-4.el9_8.1
- image-builder-0:52.1-1.el9_8.2
- git-lfs-0:3.7.1-4.el9_8.3
- golang-0:1.26.7-1.el9_2
- osbuild-composer-0:76.1-9.el9_2
- ignition-0:2.15.0-2.el9_2.1
- golang-0:1.26.7-1.el9_4
- osbuild-composer-0:101.3-4.el9_4.6
- ignition-0:2.17.0-2.el9_4.2
- golang-0:1.26.7-1.el9_6
- RHSA-2026:60306
- RHSA-2026:62577
- RHSA-2026:62578
- RHSA-2026:62631
- RHSA-2026:63022
- RHSA-2026:63119
- RHSA-2026:63127
- RHSA-2026:63332
- RHSA-2026:64777
- RHSA-2026:64788
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Mitigation
Upgrade to a fixed release: golang-0:1.26.7-1.el10_2, go-fdo-client-0:1.0.0-4.el10_2.7, go-fdo-server-0:1.0.1-2.el10_2.4, golang-github-openprinting-ipp-usb-0:0.9.27-7.el10_2.3, grafana-0:10.2.6-28.el10_2.5, grafana-pcp-0:5.3.0-8.el10_2.1. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 22 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.