Executive brief
Go's path resolution function suffered from inefficient handling of relative paths containing parent directory ("..") segments, causing excessive memory allocation and processing time. An attacker could craft malicious paths to trigger a denial-of-service condition by exhausting system resources or significantly slowing application performance.
Technical details
The vulnerability exists in Go's path resolution logic, which previously performed string conversions and buffer rewrites on each parent directory ("..") segment, resulting in quadratic time complexity and excessive memory overhead. An attacker can exploit this by providing relative paths with many ".." segments to cause high CPU and memory consumption. The attack requires no authentication and is network-reachable if the affected path resolution is exposed through a network service. The fix replaces the inefficient string-based approach with index-based backtracking on a byte buffer, eliminating the quadratic complexity and reducing memory allocations.
Affected products
- Go Go
Timeline
- 2026-08-13: disclosed