Peter Ullrich

gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

CRLF injection in HTTP/1 request line via unvalidated method in Mint

ex_aws_sns SigningCertURL not validated in verify_message/1

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

Cross-session PubSub topic injection via URL parameter in phoenix_storybook

Client-supplied URI scheme trusted without transport verification in bandit