golang: net/url: Memory exhaustion in query parameter parsing in net/url

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted...

Directory Traversal

Overview std/net/url is a Go standard library package std/net/url Affected versions of this package are vulnerable to Directory Traversal. Go Vulnerability Report: JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example, JoinPath"https://go.dev", "../go"...

Incorrect Authorization

Overview std/net/url is a Go standard library package std/net/url Affected versions of this package are vulnerable to Incorrect Authorization. Go Vulnerability Report: The url.Parse function accepts URLs with malformed hosts, such that the Host field can have arbitrary suffixes that appear in...