go -- multiple vulnerabilities

The Go project reports:

net/http: handle server errors after sending GOAWAY
A closing HTTP/2 server connection could hang forever
waiting for a clean shutdown that was preempted by a
subsequent fatal error. This failure mode could be
exploited to cause a denial of service.

net/url: JoinPath does not strip relative path components
in all circumstances
JoinPath and URL.JoinPath would not remove …/ path
components appended to a relative path.