CVE-2026-56860

NameCVE-2026-56860
DescriptionPreviously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1144340, 1144341, 1144342

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
golang-1.15 (PTS)bullseye1.15.15-1~deb11u4vulnerable
golang-1.19 (PTS)bookworm1.19.8-2vulnerable
golang-1.24 (PTS)trixie1.24.4-1vulnerable
golang-1.25 (PTS)forky, sid1.25.12-1vulnerable
golang-1.26 (PTS)forky, sid1.26.5-1vulnerable
golang-1.27 (PTS)forky, sid1.27~rc2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
golang-1.15source(unstable)(unfixed)
golang-1.19source(unstable)(unfixed)
golang-1.24source(unstable)(unfixed)
golang-1.25source(unstable)(unfixed)1144342
golang-1.26source(unstable)(unfixed)1144341
golang-1.27source(unstable)(unfixed)1144340

Notes

[trixie] - golang-1.24 <no-dsa> (Minor issue)
https://github.com/golang/go/issues/80494
Fixed by: https://github.com/golang/go/commit/bd62f0c26450224a26857a6d38a738d31f8fbaf6 (go1.27rc3)
Fixed by: https://github.com/golang/go/commit/128893dbf9a6b4d6e7c99942096e2c0018d6fe57 (go1.26.6)
Fixed by: https://github.com/golang/go/commit/962b300d32b68fd5f3c11674f711fc0e86251664 (go1.25.13)

Search for package or bug name: Reporting problems