Go net/url CVE-2026-56860

Upgrade to Go 1.26.6 or Go 1.25.13, released August 13, 2026, which contain the corrected O(n) resolvePath implementation as documented in the Go release notes (https://seclists.org/oss-sec/2026/q3/487) and Go issue #80494 (https://go.dev/issue/80494). After upgrading the Go toolchain, all affected binaries must be recompiled and redeployed, as the fix is in the standard library source and is not applied dynamically. As a compensating control where immediate toolchain upgrade is not feasible, application-level input validation that enforces a maximum URL path length or limits the count of '..' segments before passing input to net/url can reduce exposure; however, this approach requires code changes, may introduce its own bugs, and does not fully substitute for the upstream fix. Rate-limiting requests at the load balancer or WAF layer can reduce the impact of high-rate DoS attempts but will not prevent a single well-crafted long path from triggering the quadratic behavior.