Peter Ullrich

YAML injection via unescaped newlines in ymlr document comments

Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5

Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax

Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

Unbounded memory allocation in highlight_lines range expansion in mdex

Atom-table exhaustion denial-of-service via JSON parse_document in MDEx