Go Standard Library Net/Url vulnerabilities
5 vulnerabilities
Known vulnerabilities in Go Standard Library Net/Url, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-56860go standard library · net/url +4749 moreAvoid quadratic complexity in resolvePath in net/urlPreviously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.CVSS5.9MediumEPSS0.55%PrioritiseCVE-2026-25679go standard library · net/url +3722 moreIncorrect parsing of IPv6 host literals in net/urlurl.Parse insufficiently validated the host/authority component and accepted some invalid URLs.CVSS7.5HighEPSS0.83%PrioritiseCVE-2025-61726go standard library · net/url +1969 moreMemory exhaustion in query parameter parsing in net/urlThe net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.CVSS7.5HighEPSS2.29%RoutineCVE-2025-47912go standard library · net/url +2335 moreInsufficient validation of bracketed IPv6 hostnames in net/urlThe Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.CVSS5.3MediumEPSS0.47%PrioritiseCVE-2022-32190go standard library · net/url +112 moreFailure to strip relative path components in net/urlJoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath("https://go.dev", "../go") returns the URL "https://go.dev/../go", despite the JoinPath documentation stating that ../ path elements are removed from the result.CVSS7.5HighEPSS2.15%