net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-53472: Improper Neutralization of Input During Web Page Generation

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

PT-2026-72008

Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs by sending POST requests to the attachments endpoint. The route was changed from a BUILDER permission check to a TABLE/WRIT...

PT-2026-72121

Name of the Vulnerable Software and Affected Versions Semaphore versions prior to 2.18.20 Description An OS command injection issue exists in the handling of the repository git url variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by...

PT-2026-72063

A vulnerability was identified in TOTOLINK A800R 4.1.2cu.5137 B20200730. This impacts the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument url leads to stack-based buffer overflow. The attack can be initiated remotely. The...

Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

Description The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post. Po...

Divi 5.0 - 5.8.1 - Contributor+ Stored XSS via Social Media Follow Skype URL

Description The theme does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post...

PT-2026-72066

Name of the Vulnerable Software and Affected Versions CKAN MCP Server versions prior to 0.4.112 Description The ckan get mqa quality and ckan get mqa quality details functions in src/tools/quality.ts use the isValidMqaServer function to validate the server url parameter. Because the validation us...

CVE-2025-71405: URL Redirection to Untrusted Site

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2026-49826: URL Redirection to Untrusted Site

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl and Aws4FetchClient.presign in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while...

CVE-2026-56860

The golang net/url package is vulnerable to a Denial of Service (DoS) condition due to quadratic time complexity during path resolution. The flaw occurs when resolving relative paths containing parent directory (..) segments, which previously triggered string conversions and buffer rewrites at ev...

CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

CVE-2026-56860 Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

GO-2026-6218 Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking f...

Denial of Service (DoS)

Overview std/net/url is a Go standard library package std/net/url Affected versions of this package are vulnerable to Denial of Service DoS. Go Vulnerability Report:Previously, resolving relative paths containing parent directory '..' segments performed string conversions and buffer rewrites on...

CVE-2026-73659 Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API

Trigger.dev is the open-source platform for building AI workflows in TypeScript. From 4.4.2 until 4.5.0, the packet presign routes in apps/webapp/app/routes/api.v1.packets.$.ts pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl and...

CVE-2026-73659

Trigger.dev CVE-2026-73659 affects the open-source platform (Trigger.dev) in versions 4.4.2–4.5.0. The packet presign routes (apps/webapp/app/routes/api.v1.packets.$.ts) pass a caller-controlled filename through resolveStoreProtocolForPacketPresign to generatePresignedUrl/generatePresignedRequest...