Jonatan Männchen / EEF

Infinite loop in Alt-Svc header parser in hackney

CRLF injection in cookie domain/path options in hackney

HTTP/1 chunked body reader ignores length cap in bandit

Unsafe Deserialization of Erlang Terms in hex_core

HTTP/2 frame size limit checked after body is buffered in bandit

Lockfile checksums not verified in Hex allows dependency integrity bypass

Password Reset Tokens Do Not Expire

Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access