Peter Ullrich

Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

Stored XSS via unescaped HTML attribute values in earmark

grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1

Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

Multipart form-data header injection in Req via unescaped name/filename/content_type

gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation