CVE-2026-56860
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Risk Assessment
The vulnerability could lead to system slowdown or memory exhaustion, but it has been fixed; no active risk after update.
Recommendation
Update the software to a patched version to avoid performance issues.
Original NVD description (English source)
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.