The vulnerability lies in the path resolution routine of the Go standard library’s net/url package, where each relative path segment containing a parent directory marker ('..') was previously handled with repeated string conversions and buffer rewrites. This caused quadratic time growth and excessive memory allocation, potentially exhausting CPU and memory resources when processing long or deeply nested relative paths. The impact is a denial-of-service condition that can be triggered by maliciously crafted URLs, compromising availability. The flaw represents both CWE-407 (Improper Resource Management) and CWE-770 (Excessive Resource Consumption).

The flaw affects the net/url package of the Go standard library. Specific affected Go releases are not enumerated in the advisory, but any version before the fix implements the inefficient algorithm. Users running Go applications that parse user-supplied URLs with many '..' segments are at risk.

The CVSS score is 5.9, indicating a medium severity. The EPSS score is <1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can supply a URL with many '..' segments to an application that uses net/url, causing CPU and memory exhaustion. The attack likely requires only network access to the target application and does not rely on authentication or privileged execution. It can be exploited in any exposed service without additional privileges.