RHSA-2023:0693

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path.

Reader.Read does not set a limit on the maximum size of file headers.

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.