Jonatan Männchen / EEF

Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation

guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

YAML injection via unescaped newlines in ymlr document comments

Boruta accepts expired JWT client assertions due to missing exp claim validation

Boruta dynamic client registration allows creation of over-privileged OAuth clients

Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

Cross-site scripting (XSS) in OAuth Device Authorization screen

ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks