grafana12.11.2

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Grafana Tempo has an Uncontrolled Resource Consumption issue

Grafana Tempo vulnerable to an out-of-memory crash

opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking

Go Net HTML parser is vulnerable to denial of service

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Grafana Tempo has Inadequate Encryption Strength

Crash when handling long CNAME response in net

Quadratic string concatenation in consumePhrase in net/mail

Quadratic string concatentation in consumeComment in net/mail

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE in net/http/internal/http2 in golang.org/x/net

Incorrect parsing of IPv6 host literals in net/url

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Apache Thrift Python, Go, PHP and Java bindings have an Infinite Loop

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Unexpected work during chain building in crypto/x509

Inefficient candidate hostname parsing in crypto/x509

Panic in Dial and LookupPort when handling NUL byte on Windows in net

Enforce maximum recursion depth in encoding/asn1

Add recursion depth guard during decode in encoding/xml

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Quadratic complexity in WordDecoder.DecodeHeader in mime

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Avoid quadratic complexity in resolvePath in net/url

Infinite loop on invalid input in golang.org/x/text

Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3

ReverseProxy forwards queries with more than urlmaxqueryparams parameters in net/http/httputil

Invoking Encrypted Client Hello privacy leak in crypto/tls

Escaper bypass leads to XSS in html/template

Arbitrary inputs are included in errors without any escaping in net/textproto

Inefficient policy validation in crypto/x509

CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

URLs in meta content attribute actions are not escaped in html/template

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Bypass of meta content URL escaping causes XSS in html/template

Fix Javascript regexp context tracking in html/template

TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

JsBraceDepth Context Tracking Bugs (XSS) in html/template

Unbounded allocation for old GNU sparse in archive/tar

Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html

Root escape via symlink plus trailing slash in os

In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html

Invoking duplicate attributes can cause XSS in golang.org/x/net/html

FileInfo can escape from a Root in os

Invoking integer overflow in NewNTUnicodeString in golang.org/x/sys/windows

OOB read in github.com/klauspost/compress/s2

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go