Peter Ullrich

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Hex trusts its bundled CA certificates when cacerts_path is set

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

hex_core decompresses registry and Erlang term API responses without size limits

Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping

Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS