The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server. http2/hpack: avoid quadratic complexity in hpack decoding Templates did not properly consider backticks as Javascript string delimiters, and as such didnot escape them as expected. Backticks are used, since ES6, for JS template literals. If a templatecontained a Go template action within a Javascript template literal, the contents of the action couldbe used to terminate the literal, injecting arbitrary Javascript code into the Go template