CVE-2026-56860
Last modified
CVE-2026-56860 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Go standard library | net/url | < 1.25.13; >= 1.26.0-0, < 1.26.6; >= 1.27.0-0, < 1.27.0-rc.3 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-56860?
How severe is CVE-2026-56860?
How do I fix CVE-2026-56860?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-56853When a server is configured to support unencrypted HTTP/2, i…7.5
- CVE-2026-56854The source-address critical option in the Permissions return…7.5
- CVE-2026-56855Previously, after a channel has been established, a maliciou…7.5
- CVE-2026-56858Previously, pathological inputs could close an unescaped '/'…6.1
- CVE-2026-56859Previously, DecodeElement would reset the depth counter caus…7.5
- CVE-2026-5686A security flaw has been discovered in Tenda CX12L 16.03.53.…8.8
- CVE-2026-56862Handshake messages, such as KeyUpdate, are always considered…7.5
- CVE-2026-56864A malicious GOSUMDB was capable of serving arbitrary module …7.5
- CVE-2026-56865A malicious GOPROXY was previously capable of forging up to …8.4
- CVE-2026-56867Rejected reason: reserved but not needed
- CVE-2026-56868Rejected reason: reserved but not needed
- CVE-2026-56869Rejected reason: reserved but not needed
Are you affected by CVE-2026-56860?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST