RHSA-2023:5947

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Not all valid JavaScript whitespace characters are considered to be whitespace.

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

Templates containing actions in unquoted HTML attributes (e.g.

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.

The HTTP/1 client does not fully validate the contents of the Host header.

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts.

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts.

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures.

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve).