CVE-2020-36567: Go Log Injection Http Path Formatcve-2020-36567-go-log-injection-http-path-format
HTTP URL path or query string data is formatted with the '%s' verb, which does not escape newline characters. An attacker can inject arbitrary log entries by embedding newlines (CRLF) in a crafted request URL. Use '%#v' or '%q' as the format verb, or sanitize the value with strconv.Quote() before including it in log output.
