Avoid quadratic complexity in resolvePath in net/url

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-56860 · Microsoft / collected KEV context

EUVD-2026-58515

GHSA-25mv-j2qr-v5jq

GO-2026-6218

BIT-golang-2026-56860

cve-program · CVE-2026-56860

• https://go.dev/cl/803681
• https://go.dev/issue/80494
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6218

euvd · EUVD-2026-58515

• https://go.dev/cl/803681
• https://go.dev/issue/80494
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6218

nvd · CVE-2026-56860

• https://go.dev/cl/803681
• https://go.dev/issue/80494
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://pkg.go.dev/vuln/GO-2026-6218

osv · GO-2026-6218

• https://go.dev/cl/803681
• https://go.dev/issue/80494
• https://groups.google.com/g/golang-announce/c/94pEornpRlI

• Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution… · Advisory content revised · 7 Nov 2026
• Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution… · Advisory content revised · 5 Nov 2026
• Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution… · Advisory content revised · 1 Nov 2026