Neil

The issue is related to the IsLocal function not correctly detecting reserved device names in some cases on Windows. Specifically, reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. This can be exploited by a remote attacker to bypass existing security restrictions. The estimated number of potentially affected devices is not specified.

A malicious HTTP/2 client can cause excessive server resource consumption by rapidly creating requests and immediately resetting them. This allows the attacker to create a new request while the existing one is still executing, despite the total number of requests being bounded by the `http2.Server.MaxConcurrentStreams` setting. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit. New requests arriving when at the limit will be queued until a handler exits, and if the request queue grows too large, the server will terminate the connection.

The issue allows restricted files to be accessed via `os.DirFS` and `http.Dir` on Windows. These functions provide access to a tree of files rooted at a given directory and permit access to Windows device files under that root. For example, `os.DirFS("C:/tmp").Open("COM1")` opens the COM1 device. Both `os.DirFS` and `http.Dir` only provide read-only filesystem access. Additionally, on Windows, an `os.DirFS` for the directory (the root of the current drive) can permit a maliciously crafted path to escape from the drive and access any path on the system. The behavior of `os.DirFS("")` has changed with the fix applied, previously treating an empty root equivalently to "/", and now returning an error.

A CRLF injection issue allows remote attackers to inject arbitrary e-mail headers via an attachment description in a flagmail notification.

The issue is related to improper bounds checking of an unspecified `userspace parameter` in the `ptrace` system call during a `PT DUMPCORE` request. This allows local users to have an unknown impact.