Jonatan Männchen / EEF

Boruta dynamic client registration allows creation of over-privileged OAuth clients

Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

Cross-site scripting (XSS) in OAuth Device Authorization screen

ftp client PASV response IP not validated against control peer, enabling SSRF and FTP bounce attacks

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

CR/LF injection in query parameter in hackney

XXE in esaml SAML library allows local file read and potential SSRF

Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain