GO-2026-6218

See a problem?
Please try reporting it to the source first.
Source
https://pkg.go.dev/vuln/GO-2026-6218
Import Source
https://vuln.go.dev/ID/GO-2026-6218.json
JSON Data
https://api.test.osv.dev/v1/vulns/GO-2026-6218
Aliases
Downstream
Related
Published
2026-08-13T21:43:54Z
Modified
2026-09-09T10:41:40Z
Summary
Avoid quadratic complexity in resolvePath in net/url
Details

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Database specific 
{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6218"
}
References

Affected packages

Go / stdlib

Package

Name
stdlib
View open source insights on deps.dev
Purl
pkg:golang/stdlib

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.25.13
Introduced
1.26.0-0
Fixed
1.26.6
Introduced
1.27.0-0
Fixed
1.27.0-rc.3

Ecosystem specific 

{
    "imports": [
        {
            "path": "net/url",
            "symbols": [
                "URL.Parse",
                "URL.ResolveReference",
                "resolvePath"
            ]
        }
    ]
}

Database specific

source 
"https://vuln.go.dev/ID/GO-2026-6218.json"