Peter Ullrich

Quadratic bignum parsing of Content-Length and Host port values in Bandit

HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Path traversal in rebar3 via unvalidated dependency app names

Path traversal in Hex via unvalidated dependency app names

Hex release-age cooldown is lifted package-wide when the locked release is retired

Hex writes unverified package tarballs to standard output in mix hex.package fetch