Jonatan Männchen / EEF

CRLF injection in HTTP/1 request line via unvalidated method in Mint

ex_aws_sns SigningCertURL not validated in verify_message/1

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

Cross-session PubSub topic injection via URL parameter in phoenix_storybook

Client-supplied URI scheme trusted without transport verification in bandit

Improper authorization in device bulk actions and device update API allows cross-organization device control

Unbounded memory consumption in WebSocket client in hackney

Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

Atom table exhaustion via unrecognized URL schemes in hackney

WebSocket permessage-deflate inflate has no output-size cap in bandit