Geoff Franks

**Name of the Vulnerable Software and Affected Versions** Go versions prior to 1.22.5 **Description** The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail. **Recommendations** Update to Go version 1.22.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the net/http/httputil.ReverseProxy proxy to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Cloud Foundry routing release versions 0.262.0 through 0.266.0 **Description** A bug in the gorouter process can cause a denial of service for applications hosted on Cloud Foundry. This occurs when client connections are closed prematurely, leading to the gorouter marking the currently selected backend as failed and removing it from the routing pool. **Recommendations** For versions 0.262.0 through 0.266.0, update to a version later than 0.266.0 to resolve the issue. As a temporary workaround, consider implementing measures to prevent premature client connection closures to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mac OS X versions prior to 10.5.3 **Description** The issue allows local users to obtain sensitive information by listing the process, as the sso util program in Single Sign-On places passwords on the command line. **Recommendations** For versions prior to 10.5.3, update to Mac OS X version 10.5.3 or later to resolve the issue.