This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-56860 →
Categories
DEBIAN-CVE-2026-56860

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, result...

Original description

The description as published by the source.

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 golang-1.19
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13 golang-1.24
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14 golang-1.26
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.6-1"}]}]
Debian:14 golang-1.27
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27~rc3-1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details