Filtered by vendor Go Standard Library Subscriptions
Filtered by product Net/url Subscriptions

Search

Switch to Advanced Search (Beta)
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-56860 1 Go Standard Library 1 Net/url 2026-08-14 N/A
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
CVE-2026-25679 2 Go Standard Library, Golang 2 Net/url, Go 2026-08-12 7.5 High
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
CVE-2025-61726 2 Go Standard Library, Golang 2 Net/url, Go 2026-02-06 7.5 High
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.