Go standard library Net/url vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Go standard library Net/url: 4 record(s), with affected versions and fixes.

CVE-2026-56860 Medium · 5.9 CWE-407 Aug 13, 2026

Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

CVE-2026-25679 High · 7.5 CWE-425 Mar 6, 2026

Incorrect parsing of IPv6 host literals in net/url

url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

CVE-2025-61726 High · 7.5 CWE-770 Jan 28, 2026

Memory exhaustion in query parameter parsing in net/url

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

CVE-2025-47912 Medium · 5.3 Oct 29, 2025

Insufficient validation of bracketed IPv6 hostnames in net/url

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[::1]/". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement.