prometheus29.27.0

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

Inefficient candidate hostname parsing in crypto/x509

Enforce maximum recursion depth in encoding/asn1

Add recursion depth guard during decode in encoding/xml

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Quadratic complexity in WordDecoder.DecodeHeader in mime

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Avoid quadratic complexity in resolvePath in net/url

Infinite loop on invalid input in golang.org/x/text

cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

Invoking Encrypted Client Hello privacy leak in crypto/tls

Arbitrary inputs are included in errors without any escaping in net/textproto

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh

Fix Javascript regexp context tracking in html/template

Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb

Root escape via symlink plus trailing slash in os

Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog

The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go