Three vulnerabilities have been discovered in the Go programming language; “net/url” accepted some invalid hosts in URLs which could result in authorisation bypass in some applications and the HTTP/2 implementation was susceptible to denial of service.