Jonatan Männchen / EEF

HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details

ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Unverified Sign in with Apple callback parameter can override verified ID token claims

Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Host filesystem path disclosure via DNS rebinding

erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose