Eric Meadows-Jönsson

Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole

Path traversal in Gleam via unvalidated package application names

Terminal escape sequence injection in Hex via unneutralized server-supplied output

Path traversal in rebar3 via unvalidated dependency app names

Path traversal in Hex via unvalidated dependency app names

Hex release-age cooldown is lifted package-wide when the locked release is retired

Hex writes unverified package tarballs to standard output in mix hex.package fetch

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror