Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-79064.json"