Jonatan Männchen / EEF

Unauthenticated denial-of-service via BEAM atom table exhaustion in membrane_mp4_plugin

Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

Multipart form-data header injection in Req via unescaped name/filename/content_type

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

CRLF injection in HTTP/1 request line via unvalidated method in Mint

ex_aws_sns SigningCertURL not validated in verify_message/1

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

Cross-session PubSub topic injection via URL parameter in phoenix_storybook