Jonatan Männchen / EEF

Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details

Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server

ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Unverified Sign in with Apple callback parameter can override verified ID token claims

XML injection in Saxy via unescaped CDATA section terminator

Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection