Product · Go standard library

net/url

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 5.9

CVE-2026-56860

Avoid quadratic complexity in resolvePath in net/url

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte…

Go standard library net/url katib-suggestion-hyperopt katib-suggestion-goptuna-compat Debian Ubuntu Azure Linux Alpine Wolfi Go

Aug 13, 2026
Medium 5.3

CVE-2025-47912

Insufficient validation of bracketed IPv6 hostnames in net/url

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://[…

Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 29, 2025