A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values.

Affected versions include emSign ECC Root CA - G3, which can allow certificate paths through distrusted emSign intermediates.

Affected versions may accept certificate paths containing distrusted emSign intermediate public keys. The private keys corresponding to these intermediates are now well known.

Version 1.0.10+ removes this root.

The webpki-roots 0.26.11 compatibility package contains no independent trust store and re-exports the roots from its separately resolved 1.x dependency. That parent dependency must resolve to 1.0.10 or newer; an older parent remains affected by this advisory.

Lack of limit on size of parsed Range headers in net/http