Eric Meadows-Jönsson

Hex trusts its bundled CA certificates when cacerts_path is set

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

hex_core decompresses registry and Erlang term API responses without size limits

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

Refresh tokens accepted as private repository credentials at the CDN

Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections