Peter Ullrich

Link Header Directive Smuggling via Unescaped target/rel/Attribute Keys in cow_link:link/1

Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server