Peter Ullrich

SOCKS5 TLS upgrade ignores caller timeout in hackney

Infinite loop in Alt-Svc header parser in hackney

CRLF injection in cookie domain/path options in hackney

HTTP/1 chunked body reader ignores length cap in bandit

HTTP/2 frame size limit checked after body is buffered in bandit

Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS

Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe