Go net/url Path-Resolution Flaw Enables Resource-Exhaustion Denial of Service

A denial-of-service vulnerability in Go’s net/url package, tracked as CVE-2026-56860 and GO-2026-6218, allows crafted relative paths containing numerous parent-directory (..) segments to trigger quadratic processing time and excessive memory allocation. Remote attackers could exhaust resources in applications that resolve untrusted URLs. Red Hat rates the flaw Important, with a CVSS v3.1 score of 7.5; the referenced CVE.org score is 5.9, reflecting a higher assessed attack complexity. None of the references reports active exploitation.

The fix replaces repeated string conversions and buffer rewrites with byte-buffer processing and index-based backtracking. Patched upstream releases are Go 1.25.13, Go 1.26.6, and Go 1.27.0-rc.3; earlier versions in the corresponding release ranges are affected. Organizations should identify applications that resolve attacker-controlled URLs and rebuild and redeploy them with patched Go versions. Red Hat lists affected components including Apache Kafka exporters, with fixes available for RHEM flightctl and Red Hat Web Terminal and “Will not fix” statuses for other components, making product-specific advisory checks necessary.