Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
individual workaround patches have been made -- all users are recommended to upgrade to a newer version. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/security/advisories/GHSA-xw37-57qp-9mm4 - https://github.com/ethereum/go-ethereum/releases/tag/v1.9.20
CVE ID: CVE-2020-26266 State: PUBLISHED Published: 2020-12-10T22:10:47 Last Updated: 2024-08-04T15:56:04.617Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-908 Description: In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - htt
ions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qhxx-j73r-qpm2 - https://github.com/tensorflow/tensorflow/commit/ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
CVE ID: CVE-2020-26267 State: PUBLISHED Published: 2020-12-10T22:10:40 Last Updated: 2024-08-04T15:56:04.539Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - http
ons 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c9f3-9wfr-wgh7 - https://github.com/tensorflow/tensorflow/commit/ebc70b7a592420d3d2f359e4b1694c236b82c7ae
CVE ID: CVE-2020-26268 State: PUBLISHED Published: 2020-12-10T22:10:35 Last Updated: 2024-08-04T15:56:03.596Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-471 Description: In affected versions of TensorFlow the tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area. If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tenso
is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault. This is because the allocator used to return the buffer data is not marked as returning an opaque handle since the needed virtual method is not overridden. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hhvc-g5hv-48c6 - https://github.com/tensorflow/tensorflow/commit/c1e1fc899ad5f8c725dcbb6470069890b5060bc7
CVE ID: CVE-2020-26269 State: PUBLISHED Published: 2020-12-10T22:10:28 Last Updated: 2024-08-04T15:56:04.075Z Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0
us, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72-3mxw - https://github.com/tensorflow/tensorflow/commit/8b5b9dc96666a3a5d27fad7179ff215e3b74b67c
CVE ID: CVE-2020-26270 State: PUBLISHED Published: 2020-12-10T22:10:23 Last Updated: 2024-08-04T15:56:03.807Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-20 Description: In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - https:/
1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-m648-33qf-v3gp - https://github.com/tensorflow/tensorflow/commit/14755416e364f17fb1870882fa778c7fec7f16e3
CVE ID: CVE-2020-26271 State: PUBLISHED Published: 2020-12-10T22:10:14 Last Updated: 2024-08-04T15:56:04.342Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: tensorflow Products: tensorflow Problem Types: CWE-125 Description: In affected versions of TensorFlow under certain cases, loading a saved model can result in accessing uninitialized memory while building the computation graph. The MakeEdge function creates an edge between one output tensor of the src node (given by output_index) and the input slot of the dst node (given by input_index). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the co
x). This is only possible if the types of the tensors on both sides coincide, so the function begins by obtaining the corresponding DataType values and comparing these for equality. However, there is no check that the indices point to inside of the arrays they index into. Thus, this can result in accessing data out of bounds of the corresponding heap allocated arrays. In most scenarios, this can manifest as unitialized data access, but if the index points far away from the boundaries of the arrays this can be used to leak addresses from the library. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - https:
s 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q263-fvxm-m5mw - https://github.com/tensorflow/tensorflow/commit/0cc38aaa4064fd9e79101994ce9872c6d91f816b
CVE ID: CVE-2020-26272 State: PUBLISHED Published: 2021-01-28T18:25:17 Last Updated: 2025-05-27T15:20:11.927Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: electron Products: electron Problem Types: CWE-668 Description: The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFram
remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9 - https://github.com/electron/electron/pull/26875 - https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c - https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208 - https:
f7e2eda9506695be58edc73c - https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208 - https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2 - https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc - https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd - https://github.com/electron/electron/releases/tag/v9.4.0 - https://www.electronjs.org/releases/stable?version=9#9.4.0
CVE ID: CVE-2020-26273 State: PUBLISHED Published: 2020-12-16T01:20:19 Last Updated: 2024-08-04T15:56:04.061Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: osquery Products: osquery Problem Types: CWE-77 Description: osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb, someone with administrative access to osquery can cause reads and writes to arbitrary sqlite databases on disk. This _does_ allow arbitrary files to be created, but they will be sqlite databases. It does not appear to allow existing non-sqlite files to be overwritten. This has been patc
ey will be sqlite databases. It does not appear to allow existing non-sqlite files to be overwritten. This has been patched in osquery 4.6.0. There are several mitigating factors and possible workarounds. In some deployments, the people with access to these interfaces may be considered administrators. In some deployments, configuration is managed by a central tool. This tool can filter for the `ATTACH` keyword. osquery can be run as non-root user. Because this also limits the desired access levels, this requires deployment specific testing and configuration. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/osquery/osquery/security/advisories/GHSA-4g56-2482-
yst Notes: - CVE Program Container: References: - https://github.com/osquery/osquery/security/advisories/GHSA-4g56-2482-x7q8 - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/SQLite%20Injection.md#remote-command-execution-using-sqlite-command---load_extension - https://github.com/osquery/osquery/commit/c3f9a3dae22d43ed3b4f6a403cbf89da4cba7c3c - https://github.com/osquery/osquery/releases/tag/4.6.0
CVE ID: CVE-2020-26274 State: PUBLISHED Published: 2020-12-16T19:30:18 Last Updated: 2024-08-04T15:56:03.939Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: sebhildebrandt Products: systeminformation Problem Types: CWE-78 Description: In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-m57p-p67h-mq74 - https://github.com/sebhildebrandt/systeminformation/commit/1faadcbf68f1b1fdd5eb2054f68fc932be3
ies/GHSA-m57p-p67h-mq74 - https://github.com/sebhildebrandt/systeminformation/commit/1faadcbf68f1b1fdd5eb2054f68fc932be32ac99 - https://www.npmjs.com/package/systeminformation
CVE ID: CVE-2020-26275 State: PUBLISHED Published: 2020-12-21T18:00:16 Last Updated: 2024-08-04T15:56:04.089Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: jupyter-server Products: jupyter_server Problem Types: CWE-601 Description: The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously
ious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: "jupyter server --ServerApp.base_url=/jupyter/". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-9f66-54xg-p
E Program Container: References: - https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-9f66-54xg-pc2c - https://github.com/jupyter-server/jupyter_server/commit/85e4abccf6ea9321d29153f73b0bd72ccb3a6bca - https://pypi.org/project/jupyter-server/ - https://advisory.checkmarx.net/advisory/CX-2020-4291
CVE ID: CVE-2020-26276 State: PUBLISHED Published: 2020-12-17T19:40:14 Last Updated: 2024-08-04T15:56:04.500Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: fleetdm Products: fleet Problem Types: CWE-290 Description: Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-va
ble to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx - https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607 - https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020 - https://github.com/mattermost/xml-roundtrip-validator - https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
CVE ID: CVE-2020-26277 State: PUBLISHED Published: 2020-12-21T21:15:14 Last Updated: 2024-08-04T15:56:03.912Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: datacharmer Products: dbdeployer Problem Types: CWE-59 Description: DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defenses. For the attack to succeed, the following factors need to contribute: 1) The user is logged in as
the computer defenses. For the attack to succeed, the following factors need to contribute: 1) The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. 2) The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack. This has been fixed in version 1.58.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/datacharmer/dbdeployer/security/advisories/GHSA-47wr-426j-fr82 - https://github.com/datacharmer/dbdeployer/commit/548e256c1de2f99746e861454e7714ec6bc9bb10
CVE ID: CVE-2020-26278 State: PUBLISHED Published: 2021-01-20T22:10:18 Last Updated: 2024-08-04T15:56:04.069Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: weaveworks Products: weave Problem Types: CWE-250 Description: Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery. Weave Net before version 2.8.0 has a vulnerability in which can allow an attacker to take over any host in the cluster. Weave Net is supplied with a manifest that runs pods on every node in a Kubernetes cluster, which are responsible for managing network connections for all other pods
s pods on every node in a Kubernetes cluster, which are responsible for managing network connections for all other pods in the cluster. This requires a lot of power over the host, and the manifest sets `privileged: true`, which gives it that power. It also set `hostPID: true`, which gave it the ability to access all other processes on the host, and write anywhere in the root filesystem of the host. This setting was not necessary, and is being removed. You are only vulnerable if you have an additional vulnerability (e.g. a bug in Kubernetes) or misconfiguration that allows an attacker to run code inside the Weave Net pod, No such bug is known at the time of release, and there are no known ins
n attacker to run code inside the Weave Net pod, No such bug is known at the time of release, and there are no known instances of this being exploited. Weave Net 2.8.0 removes the hostPID setting and moves CNI plugin install to an init container. Users who do not update to 2.8.0 can edit the hostPID line in their existing DaemonSet manifest to say false instead of true, arrange some other way to install CNI plugins (e.g. Ansible) and remove those mounts from the DaemonSet manifest. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weaveworks/weave/security/advisories/GHSA-pg3p-v8c6-c6h3 - https://github.com/weaveworks/weave/commit/a0ac81b3b4cae6d0dcaf3732fd9
s/weave/security/advisories/GHSA-pg3p-v8c6-c6h3 - https://github.com/weaveworks/weave/commit/a0ac81b3b4cae6d0dcaf3732fd91cedefc89f720 - https://github.com/weaveworks/weave/pull/3876 - https://github.com/weaveworks/weave/blob/master/CHANGELOG.md#release-280
CVE ID: CVE-2020-26279 State: PUBLISHED Published: 2021-03-24T20:20:14 Last Updated: 2024-08-04T15:56:04.169Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: ipfs Products: go-ipfs Problem Types: CWE-22 Description: go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1. Additional Analyst Note
issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222g - https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2 - https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227
CVE ID: CVE-2020-26280 State: PUBLISHED Published: 2020-12-18T18:25:16 Last Updated: 2024-08-04T15:56:03.874Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: OpenSlides Products: OpenSlides Problem Types: CWE-79 Description: OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. OpenSlides version 3.2, due to unsufficient user input validation and escaping, it is vulnerable to persistant cross-site scripting (XSS). In the web applications users can enter rich text in various places, e.g. for personal notes or in motions. These fields can be used to store arbitrary JavaScript Co
text in various places, e.g. for personal notes or in motions. These fields can be used to store arbitrary JavaScript Code that will be executed when other users read the respective text. An attacker could utilize this vulnerability be used to manipulate votes of other users, hijack the moderators session or simply disturb the meeting. The vulnerability was introduced with 6eae497abeab234418dfbd9d299e831eff86ed45 on 16.04.2020, which is first included in the 3.2 release. It has been patched in version 3.3 ( in commit f3809fc8a97ee305d721662a75f788f9e9d21938, merged in master on 20.11.2020). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSlides/OpenSli
r on 20.11.2020). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-w5wr-98qm-jx92 - https://github.com/OpenSlides/OpenSlides/pull/5714 - https://github.com/OpenSlides/OpenSlides/commit/f3809fc8a97ee305d721662a75f788f9e9d21938 - https://github.com/OpenSlides/OpenSlides/blob/master/CHANGELOG.rst#version-33-2020-12-18 - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-043.txt
CVE ID: CVE-2020-26281 State: PUBLISHED Published: 2020-12-21T21:50:13 Last Updated: 2024-08-04T15:56:03.655Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: http-rs Products: async-h1 Problem Types: CWE-444 Description: async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications. If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that
onger than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body. One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request. Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and
quests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary. This has been addressed in async-h1 2.3.0 and previous versions have been yanked. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/http-rs/async-h1/security/advisories/GHSA-4vr9-8cjf-vf9c - https://github.com/http-rs/async-h1/releases/tag/v2.3.0