CVE-2026-56860

Received Received - Intake

Path Traversal in Go Standard Library

Publication date: 2026-08-13

Last updated on: 2026-08-14

Assigner: Go Project

Description

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-14

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-56860

EUVD

EUVD-2026-58515

Affected Vendors & Products

Vendor	Product	Version / Range
golang	go	to 1.25.13 (exc)
golang	go	From 1.26.0 (inc) to 1.26.6 (exc)
golang	go	From 1.27.0 (inc) to 1.27.0-rc.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability involves inefficient path resolution in Go that previously caused quadratic time complexity and high memory overhead when handling relative paths with parent directory segments ('..'). The issue has been addressed by optimizing path resolution using a byte buffer with index-based backtracking.

Detection Guidance

This CVE describes a performance issue in path resolution for Go applications, not a traditional vulnerability with network/system detection methods. Monitor Go applications for high CPU or memory usage during path operations. Check Go runtime versions for affected releases.

Impact Analysis

The vulnerability could lead to performance degradation or resource exhaustion in applications processing many relative paths, potentially causing slowdowns or crashes. Systems relying on path manipulation may experience increased latency or instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it relates to performance inefficiencies in path resolution rather than data security or privacy violations.

Mitigation Strategies

Update Go to the latest stable version to benefit from the optimized path resolution. Review applications using custom path resolution logic and replace with Go's standard library functions. Monitor performance metrics for path-heavy operations.

Hi! I’m here to help you understand CVE-2026-56860. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70