RHSA-2023:3318

Not all valid JavaScript whitespace characters are considered to be whitespace.

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts.

Templates containing actions in unquoted HTML attributes (e.g.

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve).