Neil Berkman

Host filesystem path disclosure via DNS rebinding

WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments