José Valim

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Cookie attribute injection in Plug.Conn.Cookies.encode/2

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service

Unbounded exponent in decimal enables unauthenticated DoS

httpc does not bound server-supplied numeric header values before integer conversion

eldap does not bound the port component of a referral URL before integer conversion

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

uri_string does not bound the port component of a URI before integer conversion