Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Double flow control refund on HTTP/2 server streams in net/http

HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

Excessive CPU consumption from repeated initial window changes in net/http

HTTP/2 transport accepts malformed framing-related headers in net/http

Lack of limit on size of parsed Range headers in net/http

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Denial of service due to improper 100-continue handling in net/http

Sensitive headers not cleared on cross-origin redirect in net/http

Exposure of client IP addresses in net/http

Improper sanitization of Transfer-Encoding headers in net/http

Sensitive headers incorrectly sent after cross-domain redirect in net/http

CrossOriginProtection insecure bypass patterns not limited to exact matches in net/http

Lack of limit when parsing cookies can cause memory exhaustion in net/http

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net