Peter Ullrich

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

CRLF injection in HTTP/1 request line via unvalidated method in Mint

ex_aws_sns SigningCertURL not validated in verify_message/1

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

Cross-session PubSub topic injection via URL parameter in phoenix_storybook

Client-supplied URI scheme trusted without transport verification in bandit

Unbounded memory consumption in WebSocket client in hackney

Atom table exhaustion via unrecognized URL schemes in hackney

WebSocket permessage-deflate inflate has no output-size cap in bandit

CRLF injection in WebSocket upgrade request in hackney