Jonatan Männchen / EEF

Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

TLS 1.3 client ticket store crashed by NewSessionTicket with empty early_data extension in ssl

HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

Unvalidated HTTP/1 request-target authority lets a client choose conn.host and conn.port in Bandit

Path traversal in rebar3 via unvalidated dependency app names

Path traversal in Hex via unvalidated dependency app names

Hex release-age cooldown is lifted package-wide when the locked release is retired

Hex writes unverified package tarballs to standard output in mix hex.package fetch

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Hex trusts its bundled CA certificates when cacerts_path is set