Jonatan Männchen / EEF

Client-supplied URI scheme trusted without transport verification in bandit

Improper authorization in device bulk actions and device update API allows cross-organization device control

Unbounded memory consumption in WebSocket client in hackney

Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

Atom table exhaustion via unrecognized URL schemes in hackney

WebSocket permessage-deflate inflate has no output-size cap in bandit

CRLF injection in WebSocket upgrade request in hackney

Missing authorization check on save-job event handler in oban_web

SSRF allowlist bypass via percent-encoded host in hackney

HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney