Path Resolution Vulnerability in Go Programming Language

CVE-2026-56860

What is CVE-2026-56860?

A vulnerability in the Go programming language's path resolution process has been identified, which previously relied on string conversions and buffer rewrites for handling relative paths containing parent directory segments ('..'). This method introduced inefficient quadratic time complexity and excessive memory allocation. The path resolution has since been optimized to operate directly on a byte buffer, utilizing index-based backtracking for '..' segments. This adjustment improves performance by eliminating the earlier quadratic time complexity and dramatically reducing memory overhead, thereby enhancing the overall efficiency of path resolution within the language.

References