RHSA-2023:5976

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Large handshake records may cause panics in crypto/tls.

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.

The HTTP/1 client does not fully validate the contents of the Host header.

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures.

The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve).