AZL-27410 CVE-2023-29406 affecting package golang for versions less than 1.20.7-1

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value...

Twisted Web DoS

The vulnerability of the Twisted Web network framework’s component involves insufficient validation of input data during the processing of HTTP headers. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...