Peter Ullrich

CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service

Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service

Atom Exhaustion via _entities Representation Keys in DivvyPayHQ absinthe_federation

Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation

Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation

guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

YAML injection via unescaped newlines in ymlr document comments

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit