RHSA-2025:9776

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations.

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status.

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts.

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not app…

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file.

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected…

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.