CVE-2026-56860
published 2026-08-13CVE-2026-56860: Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in…
PriorityP434medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.55%
45.3th percentile
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Affected
108 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 3scale-amp2 | 3scale-operator-bundle | — | — |
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| albo | aws-load-balancer-operator | — | — |
| albo | aws-load-balancer-rhel8-operator | — | — |
| ansible-automation-platform-26 | receptor-rhel9 | — | — |
| ansible-automation-platform-27 | receptor-rhel9 | — | — |
| ansible-automation-platform | platform-operator-bundle | — | — |
| apache | thrift | — | — |
| build-of-trustee | trustee-rhel9-operator | — | — |
| buildah_project | buildah | — | — |
| cert-manager | jetstack-cert-manager-rhel9 | — | — |
| compliance | openshift-compliance-operator-bundle | — | — |
| compliance | openshift-selinuxd-rhel8 | — | — |
| confidential-containers | trustee | — | — |
| container-native-virtualization | kubemacpool-rhel9 | — | — |
| container-tools_rhel8 | buildah | — | — |
| container-tools_rhel8 | conmon | — | — |
| container-tools_rhel8 | containernetworking-plugins | — | — |
| container-tools_rhel8 | crun | — | — |
| container-tools_rhel8 | oci-seccomp-bpf-hook | — | — |
| container-tools_rhel8 | podman | — | — |
| container-tools_rhel8 | runc | — | — |
| container-tools_rhel8 | skopeo | — | — |
| container-tools_rhel8 | toolbox | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory a
ghsa_unreviewed·2026-08-14
CVE-2026-56860 Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory a
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
VulDB
Go standard library url up to 1.25.12/1.26.5 Path Resolution algorithmic complexity
vuldb·2026-08-14
CVE-2026-56860 [LOW] Go standard library url up to 1.25.12/1.26.5 Path Resolution algorithmic complexity
A vulnerability was found in Go standard library url up to 1.25.12/1.26.5 and classified as problematic. Affected by this issue is some unknown functionality of the component Path Resolution. Such manipulation leads to inefficient algorithmic complexity.
This vulnerability is listed as CVE-2026-56860. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
Red Hat
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
vendor_redhat·2026-08-13·CVSS 5.9
CVE-2026-56860 [MEDIUM] CWE-770 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.
Package: rhai/assisted-installer-rhel9 (Assisted Installer for Red Hat OpenShift Container Platform 2) - Affected
Package: albo/aws-load-balancer-operator (AWS Load Balancer Operator) - Affected
Package: albo/aws-load-balancer-rhel8-operator (AWS Load Balancer Operator) - Affected
Package: openshift-builds/open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-56860 go-rpm-macros: golang net/url: Denial of Service from quadratic complexity in path resolution [fedora-all]
bugzilla·2026-09-11·CVSS 5.9
CVE-2026-56860 [MEDIUM] CVE-2026-56860 go-rpm-macros: golang net/url: Denial of Service from quadratic complexity in path resolution [fedora-all]
CVE-2026-56860 go-rpm-macros: golang net/url: Denial of Service from quadratic complexity in path resolution [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Bugzilla
CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
bugzilla·2026-08-13·CVSS 5.9
CVE-2026-56860 [MEDIUM] CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Bugzilla
CVE-2026-64309 kernel: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
bugzilla·2026-07-25
CVE-2026-64309 [MEDIUM] CVE-2026-64309 kernel: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
CVE-2026-64309 kernel: crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT)
Sashiko notes:
> if SEV initialization fails and KVM is actively running normal VMs, could a
> userspace process trigger this code path via /dev/sev ioctls (e.g.,
> SEV_PDH_GEN) and zero out MSR_VM_HSAVE_PA globally? Would the next VMRUN
> execution for an active VM trigger a general protection fault and crash the
> host?
The SNP_COMMIT command does not require the firmware to be in any
particular state. Skip initializing it if it was previously uninitialized.
The SEV-SNP firmware specification doc 56860 does not mention SNP_COMMIT in
Table 5 as a command that is allowed in the UN
2026-08-13
Published