Jonatan Männchen / EEF

Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment

Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

Missing ID token claim validation in ueberauth_apple allows account takeover

Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

Private action arguments can be set by user input in Ash

mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5