[FREEBSD:C092BE0E-F7CC-11EE-AA6B-B42E991FC52E] forgejo -- HTTP/2 CONTINUATION flood in net/http

security@golang.org reports:

  An attacker may cause an HTTP/2 endpoint to read arbitrary amounts
of header data by sending an excessive number of CONTINUATION frames.
Maintaining HPACK state requires parsing and processing all HEADERS
and CONTINUATION frames on a connection.  When a request's
headers exceed MaxHeaderBytes, no memory is allocated to store the
excess headers, but they are still parsed.  This permits an attacker
to cause an HTTP/2 endpoint to read arbitrary amounts of header
data, all associated with a request which is going to be rejected.
These headers can include Huffman-encoded data which is significantly
more expensive for the receiver to decode than for an attacker to
send.  The fix sets a limit on the amount of excess header frames
we will process before closing a connection.