RHSA-2023:0584

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

Large handshake records may cause panics in crypto/tls.

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path.

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.