Tommaso Innocenti

The issue is related to the net/http package in Go, where an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error, leading to a denial of service. This can be exploited by a malicious client. The vulnerability is also associated with a lack of input data sanitization, which can impact the confidentiality, integrity, and availability of protected information.

The issue is related to improper input validation in HTTP/2 frame handling, which can be exploited by an attacker to smuggle requests. This can potentially allow a remote attacker to execute arbitrary code due to weaknesses in handling HTTP requests.