Jonatan Männchen / EEF

ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

Unbounded exponent in decimal enables unauthenticated DoS

httpc does not bound server-supplied numeric header values before integer conversion

eldap does not bound the port component of a referral URL before integer conversion

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

uri_string does not bound the port component of a URI before integer conversion