CVE 2020-24553

Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.

Related bugs and status

CVE-2020-24553 (Candidate) is related to these bugs:

Bug #1914372: Ubuntu packages affected by CVE-2020-24553

		In	Importance	Status
1914372	Ubuntu packages affected by CVE-2020-24553	golang-1.14 (Ubuntu)	Low	Fix Released
1914372	Ubuntu packages affected by CVE-2020-24553	golang-1.14 (Ubuntu Groovy)	High	Fix Released
1914372	Ubuntu packages affected by CVE-2020-24553	golang-1.14 (Ubuntu Focal)	High	Fix Released
1914372	Ubuntu packages affected by CVE-2020-24553	golang-1.14 (Ubuntu Hirsute)	Low	Fix Released
1914372	Ubuntu packages affected by CVE-2020-24553	golang-1.10 (Ubuntu Bionic)	High	Fix Released
1914372	Ubuntu packages affected by CVE-2020-24553	golang-1.10 (Ubuntu Xenial)	High	Fix Released
1914372	Ubuntu packages affected by CVE-2020-24553	golang-1.15 (Ubuntu)	Low	Fix Released

See the

CVE page on Mitre.org for more details.