Daniel Coles

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

pgjdbc does not enforce requireAuth when the value excludes every authentication method