This vulnerability involves inefficient algorithmic complexity (CWE-407) in the Go standard library's net/url package when resolving relative paths with '..' segments. The original implementation performed string conversions and buffer rewrites at each step, resulting in quadratic time complexity and excessive memory allocations. The updated implementation uses a byte buffer and index-based backtracking to improve performance and reduce memory overhead.

The inefficient algorithmic complexity could lead to performance degradation and high memory consumption when processing certain relative paths. There is no indication of direct security impact such as code execution or data leakage. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time.