Peter Ullrich

Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Path traversal in Hex via unvalidated dependency app names

Hex release-age cooldown is lifted package-wide when the locked release is retired

Hex writes unverified package tarballs to standard output in mix hex.package fetch

hex_core decompresses registry and Erlang term API responses without size limits

Hex trusts its bundled CA certificates when cacerts_path is set

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25

Path traversal in Gleam via unvalidated package application names

Path traversal in rebar3 via unvalidated dependency app names