Denial of service and SSRF via unbounded http.Get() in Ref.IsValidURI() in github.com/go-openapi/spec. IsValidURI resolved an absolute-URL $ref by issuing http.Get on http.DefaultClient, which has no timeout and no cancellation, so an attacker-controlled URL that never responds blocks indefinitely and leaks goroutines, sockets and file descriptors. The bare GET to a caller-supplied URL is also an SSRF vector against internal addresses. Fixed in v0.22.7 by treating a well-formed absolute URL as valid without any network request.