CVE-2026-56860

CVE-2026-56860 affects Go’s net/url path resolution. The issue was a quadratic-time, high-memory operation when resolving relative paths with .. segments due to repeated string conversions and buffer rewrites. The fix replaces this with byte-buffer-based path resolution using index-based backtrac...