Peter Ullrich

Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service

Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex

Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

Stored XSS via unescaped HTML attribute values in earmark

grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

Multipart form-data header injection in Req via unescaped name/filename/content_type