Peter Ullrich

Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

HTTP/2 inbound flow control is not enforced, letting a client queue unbounded DATA in stream processes in Bandit

HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Quadratic bignum parsing of Content-Length and Host port values in Bandit