Jonatan Männchen / EEF

uri_string does not bound the port component of a URI before integer conversion

Megaco flex scanner buffer overflow via oversized property parm name

TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness