Jonatan Männchen / EEF

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

CR/LF injection in query parameter in hackney

XXE in esaml SAML library allows local file read and potential SSRF

Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain

Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment

Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

Missing ID token claim validation in ueberauth_apple allows account takeover

Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS