Jonatan Männchen / EEF

Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

Unbounded SAML message decompression in esaml allows memory exhaustion

Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion

Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion

Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit