Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Double flow control refund on HTTP/2 server streams in net/http

HTTP/2 server crash due to HPACK encoder race in net/http

HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http

Excessive CPU consumption from repeated initial window changes in net/http

HTTP/2 transport accepts malformed framing-related headers in net/http

Lack of limit on size of parsed Range headers in net/http

HTTP/1 client connection desynchronization after CONNECT rejection in net/http

HTTP/2 server memory exhaustion due to Trailer headers in net/http

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Exposure of client IP addresses in net/http

Improper sanitization of Transfer-Encoding headers in net/http