net/http: HTTP/2 server crash due to HPACK encoder race net/http: HTTP/2 server memory exhaustion due to Trailer headers crypto/tls: reject malformed ECH outer extension references cmd/go: checksum bypass for golang.org/fips140 cmd/go: checksum database bypass for golang.org/toolchain html/template: reset context tracking on consecutive template expressions html/template: recognize |yield| as regexp preceder keyword net/textproto, mime/multipart: memory limit bypass when parsing MIME headers net/http: HTTP/1 client connection desynchronization after CONNECT rejection net/http: HTTP/1 server connection desynchronization after 2xx CONNECT response net/http: excessive CPU consumption from repeated initial window changes net/http: HTTP/2 transport accepts malformed framing-related headers net/http: lack of limit on size of parsed Range headers net/http: double flow control refund on HTTP/2 server streams