The Go project reports reports:
crypto/x509: Verify panics on certificates with an
unknown public key algorithm
Verifying a certificate chain which contains a
certificate with an unknown public key algorithm will
cause Certificate.Verify to panic.
net/http: memory exhaustion in Request.ParseMultipartForm
When parsing a multipart form (either explicitly with
Request.ParseMultipartForm or implicitly with Request.FormValue,
Request.PostFormValue, or Request.FormFile), limits on the total
size of the parsed form were not applied to the memory consumed
while reading a single form line. This permitted a maliciously
crafted input containing very long lines to cause allocation of
arbitrarily large amounts of memory, potentially leading to memory
exhaustion.
net/http, net/http/cookiejar: incorrect forwarding
of sensitive headers and cookies on HTTP redirect
When following an HTTP redirect to a domain which
is not a subdomain match or exact match of the initial
domain, an http.Client does not forward sensitive headers
such as "Authorization" or "Cookie". For example, a
redirect from foo.com to www.foo.com will forward the
Authorization header, but a redirect to bar.com will not.
html/template: errors returned from MarshalJSON methods
may break template escaping
If errors returned from MarshalJSON methods contain user
controlled data, they may be used to break the contextual
auto-escaping behavior of the html/template package, allowing
for subsequent actions to inject unexpected content into
templates.
net/mail: comments in display names are incorrectly handled
The ParseAddressList function incorrectly handles comments
(text within parentheses) within display names. Since this is a
misalignment with conforming address parsers, it can result in
different trust decisions being made by programs using different
parsers.