CVE-2026-56860

EUVD-2026-58515
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.79%
Debian logo
Debian Releases
Debian Product
Codename
golang-1.19
bookworm
postponed
golang-1.24
trixie
no-dsa
golang-1.25
forky
vulnerable
golang-1.26
forky
1.26.8-1
fixed
sid
1.26.8-1
fixed
golang-1.27
forky
1.27.1-2
fixed
sid
1.27.1-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
golang
jammy
dne
noble
dne
resolute
dne
golang-1.6
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
golang-1.8
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
golang-1.9
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
golang-1.10
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
trusty
needs-triage
xenial
needs-triage
golang-1.13
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
resolute
dne
xenial
needs-triage
golang-1.14
focal
needs-triage
jammy
dne
noble
dne
resolute
dne
golang-1.16
bionic
needs-triage
focal
needs-triage
jammy
dne
noble
dne
resolute
dne
golang-1.17
jammy
needs-triage
noble
dne
resolute
dne
golang-1.18
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
dne
resolute
dne
xenial
needs-triage
golang-1.20
focal
needs-triage
jammy
needs-triage
noble
dne
resolute
dne
golang-1.21
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
golang-1.22
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
golang-1.23
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
golang-1.24
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
golang-1.25
jammy
dne
noble
dne
resolute
needs-triage
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
buildah
RHEL 9
2:1.43.3-2.el9_8
fixed
buildah-tests
RHEL 9
2:1.43.3-2.el9_8
fixed
containernetworking-plugins
RHEL 9
1:1.9.0-4.el9_8
fixed
git-lfs
RHEL 9
0:3.7.1-4.el9_8.3
fixed
go-toolset
RHEL 9
0:1.26.7-1.el9_8
fixed
golang
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-bin
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-docs
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-misc
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-race
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-src
RHEL 9
0:1.26.7-1.el9_8
fixed
golang-tests
RHEL 9
0:1.26.7-1.el9_8
fixed
grafana
RHEL 8
0:9.2.10-33.el8_10
fixed
RHEL 9
0:10.2.6-23.el9_8.3
fixed
grafana-pcp
RHEL 9
0:5.1.1-17.el9_8.1
fixed
grafana-selinux
RHEL 8
0:9.2.10-33.el8_10
fixed
RHEL 9
0:10.2.6-23.el9_8.3
fixed
image-builder
RHEL 9
0:52.1-1.el9_8.2
fixed
opentelemetry-collector
RHEL 9
0:0.152.1-2.el9_8
fixed
osbuild-composer
RHEL 8
0:101.5-2.el8_10
fixed
RHEL 8.6 AUS
0:46.3-8.el8_6
fixed
RHEL 8.8 E4S
0:75-10.el8_8
fixed
RHEL 8.8 TUS
0:75-10.el8_8
fixed
RHEL 9
0:165.1-4.el9_8.1
fixed
osbuild-composer-core
RHEL 8
0:101.5-2.el8_10
fixed
RHEL 8.6 AUS
0:46.3-8.el8_6
fixed
RHEL 8.8 E4S
0:75-10.el8_8
fixed
RHEL 8.8 TUS
0:75-10.el8_8
fixed
RHEL 9
0:165.1-4.el9_8.1
fixed
osbuild-composer-dnf-json
RHEL 8.6 AUS
0:46.3-8.el8_6
fixed
RHEL 8.8 E4S
0:75-10.el8_8
fixed
RHEL 8.8 TUS
0:75-10.el8_8
fixed
osbuild-composer-worker
RHEL 8
0:101.5-2.el8_10
fixed
RHEL 8.6 AUS
0:46.3-8.el8_6
fixed
RHEL 8.8 E4S
0:75-10.el8_8
fixed
RHEL 8.8 TUS
0:75-10.el8_8
fixed
RHEL 9
0:165.1-4.el9_8.1
fixed
podman
RHEL 9
6:5.8.2-7.el9_8
fixed
podman-docker
RHEL 9
6:5.8.2-7.el9_8
fixed
podman-plugins
RHEL 9
6:5.8.2-7.el9_8
fixed
podman-remote
RHEL 9
6:5.8.2-7.el9_8
fixed
podman-tests
RHEL 9
6:5.8.2-7.el9_8
fixed
rhc
RHEL 9
1:0.2.7-11.el9_8
fixed
rhc-devel
RHEL 9
1:0.2.7-11.el9_8
fixed
runc
RHEL 9
4:1.4.2-3.el9_8
fixed
skopeo
RHEL 9
2:1.22.2-8.el9_8
fixed
skopeo-tests
RHEL 9
2:1.22.2-8.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
golang
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-bin
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-docs
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-misc
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-shared
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-src
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed
golang-tests
Amazon Linux 2
0:1.26.7-1.amzn2.0.1
fixed
Amazon Linux 2023
0:1.26.7-1.amzn2023.0.1
fixed