RHSA-2023:5964

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

Large handshake records may cause panics in crypto/tls.

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts.

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures.