Previously

CVE-2026-56860 is a denial-of-service flaw in Go's standard library net/url package, specifically in the resolvePath function called by URL.Parse and URL.ResolveReference. When processing relative URL paths containing parent-directory (..) segments, the old implementation performed a full string conversion and buffer rewrite at every step, producing O(n²) time complexity and proportionally bloated memory allocations. An attacker who can feed a crafted URL with a long chain of .. segments into a Go service can spike CPU and heap usage on that process. Affected versions: Go < 1.25.13, Go 1.26.0 through 1.26.5, and Go 1.27.0-rc.1/rc.2. Fixed in Go 1.25.13, 1.26.6, and 1.27.0-rc.3.

The vendor's MEDIUM / 5.9 rating is directionally correct but slightly generous. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) already captures the high attack complexity and availability-only impact. In practice, several additional friction layers — HTTP URL-length ceilings, Go's goroutine-per-request model that isolates slow parsing to a single goroutine, the need for sustained concurrent malicious requests to actually degrade service, and the total absence of public PoC code or in-the-wild exploitation — all compound to make the real-world risk incrementally lower than what the raw CVSS communicates. A 4.8 better reflects the actual threat to a managed fleet.

1. Run govulncheck across your Go module inventory — Use govulncheck ./... in each Go module to determine whether your application's call graph actually reaches the vulnerable url.URL.Parse or url.URL.ResolveReference symbols. If govulncheck reports no reachable usage, the binary is not exploitable regardless of Go version. This triage step eliminates false positives and focuses patching effort. No mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.
2. Enforce URL length limits at the edge — Configure your reverse proxy, WAF, or load balancer to reject request URLs exceeding a reasonable length (e.g. 8 KB). This caps the quadratic blowup factor and neutralizes the DoS potential. Most production deployments already have this in place. Apply within the 365-day remediation window.
3. Normalize paths at the proxy layer — Enable path normalization (resolve .. segments) at your reverse proxy (nginx merge_slashes, Envoy path normalization, Cloudflare URL rewriting). This strips the malicious .. chains before they reach Go, eliminating the trigger entirely.
4. Rebuild and redeploy with Go ≥ 1.25.13 / 1.26.6 — The definitive fix is recompiling your Go binaries with a patched Go toolchain. Prioritize services that are internet-facing and process untrusted URLs. Target completion within the noisgate 365-day remediation SLA for MEDIUM severity.
5. Enable rate limiting on URL-processing endpoints — Apply per-client rate limiting at the application or proxy level to prevent the sustained concurrent requests needed to escalate a single-goroutine slowdown into service-level DoS.

Run this script on any host where Go binaries are deployed. It checks the Go toolchain version and optionally scans specified binaries for their embedded Go version. Requires go in PATH for toolchain check, or pass binary paths as arguments. No elevated privileges needed. Example: bash check_cve_2026_56860.sh /usr/local/bin/myservice /usr/bin/kubectl

#!/usr/bin/env bash
# check_cve_2026_56860.sh — Detect Go net/url quadratic path resolution DoS
# CVE-2026-56860 | GO-2026-6218
# Affected: Go < 1.25.13, Go 1.26.0-1.26.5, Go 1.27.0-rc.1/rc.2
# Fixed:    Go 1.25.13+, Go 1.26.6+, Go 1.27.0-rc.3+
# Usage:    bash check_cve_2026_56860.sh [binary1 binary2 ...]
# Output:   VULNERABLE / PATCHED / UNKNOWN

set -euo pipefail

VULNERABLE=0
PATCHED=0
UNKNOWN=0

check_version() {
  local label="$1"
  local ver="$2"
  # Strip 'go' prefix if present
  ver="${ver#go}"
  # Extract major.minor.patch
  local major minor patch
  IFS='.' read -r major minor patch <<< "$(echo "$ver" | sed 's/-.*//; s/rc.*//')"
  patch="${patch:-0}"
  local rc=""
  if [[ "$ver" == *"-rc."* ]]; then
    rc="$(echo "$ver" | grep -oP 'rc\.\K[0-9]+')"
  elif [[ "$ver" == *"rc"* ]]; then
    rc="$(echo "$ver" | grep -oP 'rc\K[0-9]+')"
  fi

  local result="UNKNOWN"

  if [[ "$major" -eq 1 ]]; then
    if [[ "$minor" -le 24 ]]; then
      # Go 1.24 and earlier — not in affected range per advisory (affected starts 1.25.0)
      result="PATCHED"  # Not in affected version range
    elif [[ "$minor" -eq 25 ]]; then
      if [[ "$patch" -ge 13 ]]; then
        result="PATCHED"
      else
        result="VULNERABLE"
      fi
    elif [[ "$minor" -eq 26 ]]; then
      if [[ "$patch" -ge 6 ]]; then
        result="PATCHED"
      else
        result="VULNERABLE"
      fi
    elif [[ "$minor" -eq 27 ]]; then
      if [[ -n "$rc" ]]; then
        if [[ "$rc" -ge 3 ]]; then
          result="PATCHED"
        else
          result="VULNERABLE"
        fi
      elif [[ "$patch" -ge 0 ]]; then
        result="PATCHED"  # 1.27.0 release or later
      fi
    elif [[ "$minor" -gt 27 ]]; then
      result="PATCHED"
    fi
  fi

  echo "[$result] $label: go$ver"
  case "$result" in
    VULNERABLE) VULNERABLE=$((VULNERABLE + 1)) ;;
    PATCHED)    PATCHED=$((PATCHED + 1)) ;;
    *)          UNKNOWN=$((UNKNOWN + 1)) ;;
  esac
}

# Check installed Go toolchain
if command -v go &>/dev/null; then
  toolchain_ver="$(go version | awk '{print $3}')"
  check_version "Go toolchain" "$toolchain_ver"
else
  echo "[INFO] Go toolchain not found in PATH"
fi

# Check specified binaries
for bin in "$@"; do
  if [[ ! -f "$bin" ]]; then
    echo "[UNKNOWN] $bin: file not found"
    UNKNOWN=$((UNKNOWN + 1))
    continue
  fi
  bin_ver="$(go version -m "$bin" 2>/dev/null | head -1 | awk '{print $2}' || true)"
  if [[ -z "$bin_ver" ]]; then
    echo "[UNKNOWN] $bin: not a Go binary or version unreadable"
    UNKNOWN=$((UNKNOWN + 1))
    continue
  fi
  check_version "$bin" "$bin_ver"
done

# Summary
echo ""
echo "=== CVE-2026-56860 Scan Summary ==="
echo "VULNERABLE: $VULNERABLE | PATCHED: $PATCHED | UNKNOWN: $UNKNOWN"

if [[ $VULNERABLE -gt 0 ]]; then
  echo "VULNERABLE"
  exit 1
elif [[ $UNKNOWN -gt 0 && $PATCHED -eq 0 ]]; then
  echo "UNKNOWN"
  exit 2
else
  echo "PATCHED"
  exit 0
fi

1. NVD — CVE-2026-56860
2. Go Vulnerability Database — GO-2026-6218
3. Go Issue #80494 — Quadratic complexity in resolvePath
4. Go Security Release Announcement (1.26.6, 1.25.13)
5. Red Hat Advisory — RHSA-2026:65886
6. OpenCVE — CVE-2026-56860 Details
7. Strix.ai — CVE-2026-56860 Analysis