Path Traversal in Go Standard Library

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Go Project

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-56860

EUVD

EUVD-2026-58515

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves inefficient path resolution in Go that previously caused quadratic time complexity and high memory overhead when handling relative paths with parent directory segments ('..'). The issue has been addressed by optimizing path resolution using a byte buffer with index-based backtracking.

Impact Analysis

The vulnerability could lead to performance degradation or resource exhaustion in applications processing many relative paths, potentially causing slowdowns or crashes. Systems relying on path manipulation may experience increased latency or instability.

Hi! I’m here to help you understand CVE-2026-56860. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70