Peter Ullrich

Unbounded exponent in decimal enables unauthenticated DoS

httpc does not bound server-supplied numeric header values before integer conversion

eldap does not bound the port component of a referral URL before integer conversion

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

uri_string does not bound the port component of a URI before integer conversion

Identity tool filter in AshAi accepts operator maps, allowing update or destroy of unidentified records

Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness