Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

EEF-CVE-2026-65623 GHSA-vg8x-66vg-5pxh CVE-2026-65623 HIGH 3 days ago

## Summary Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion d...

hex

No PRs yet

Missing gas_limit validation in mpp Tempo fee-payer enables wallet drain

EEF-CVE-2026-59252 GHSA-vj8p-hp9x-gh47 CVE-2026-59252 HIGH 10 days ago

## Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet...

hex

No PRs yet

Unbounded access list in mpp Tempo fee-payer inflates gas cost per payment

EEF-CVE-2026-59694 GHSA-qpxh-ff8m-c62v CVE-2026-59694 HIGH 10 days ago

## Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's ga...

hex

No PRs yet

Unbounded max_fee_per_gas in mpp Tempo fee-payer enables single-request wallet drain

EEF-CVE-2026-59695 GHSA-vv77-66rf-pm86 CVE-2026-59695 HIGH 10 days ago

## Summary Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to drain the fee-payer wallet...

hex

No PRs yet

Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections

EEF-CVE-2026-59249 GHSA-x3x7-96vm-6h2w CVE-2026-59249 MEDIUM 11 days ago

## Summary Inconsistent interpretation of HTTP requests (HTTP response smuggling) vulnerability in elixir-mint mint allows a malicious HTTP/1 serv...

hex

No PRs yet

Protobuf: Unbounded recursion depth in embedded-message decoding

GHSA-rv48-qqj5-crxg CVE-2026-54451 HIGH 12 days ago

### Summary Unbounded recursion depth in `Protobuf.Decoder` (Hex package `protobuf`, versions `>= 0.8.0, < 0.16.1`) lets an unauthenticated attack...

hex

No PRs yet

Missing ID token claim validation in ueberauth_apple allows account takeover

EEF-CVE-2026-55954 GHSA-pxx8-68pc-p9mr CVE-2026-55954 CRITICAL 13 days ago

## Summary Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth\_apple allows account takeover via unvalidated ID token claims. ...

hex

No PRs yet

Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory

EEF-CVE-2026-59246 GHSA-8pf6-g464-h6h9 CVE-2026-59246 MEDIUM 13 days ago

## Summary Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory on the client ...

hex

No PRs yet

Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS

EEF-CVE-2026-58229 GHSA-qrfr-wh4c-3qhw CVE-2026-58229 HIGH 13 days ago

## Summary Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client ho...

hex

No PRs yet

Scheme validation bypass in Phoenix.LiveView.Utils leads to XSS via <.link>

EEF-CVE-2026-58228 GHSA-5cgh-g58j-m9cq CVE-2026-58228 MEDIUM 14 days ago

## Summary Cross-site scripting vulnerability in phoenixframework phoenix\_live\_view allows an attacker to bypass URL scheme validation and execu...

hex

No PRs yet

Cookie attribute injection in Plug.Conn.Cookies.encode/2

EEF-CVE-2026-56813 GHSA-wpmj-jh88-rpgm CVE-2026-56813 LOW 17 days ago

## Summary Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTT...

hex

No PRs yet

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

EEF-CVE-2026-56814 GHSA-95qv-c9g9-rm63 CVE-2026-56814 MEDIUM 17 days ago

## Summary Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length...

hex

No PRs yet

SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

EEF-CVE-2026-58225 GHSA-4mw9-4qgj-m97w CVE-2026-58225 LOW 17 days ago

## Summary SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the r...

hex

No PRs yet

Tesla vulnerable to multipart part smuggling via unescaped `content-disposition` values

GHSA-28jh-g32x-v9v4 CVE-2026-48598 LOW 18 days ago

### Summary `Tesla.Multipart.part_headers_for_disposition/1` interpolates `Content-Disposition` parameter values (field name, filename, and other ...

hex

No PRs yet

Tesla vulnerable to atom exhaustion via untrusted URL scheme

GHSA-h74c-q9j7-mpcm CVE-2026-48597 HIGH 18 days ago

### Summary In the Mint adapter for the Tesla HTTP client library, `Tesla.Adapter.Mint.open_conn/2` passes the URL scheme of every outgoing reques...

hex

No PRs yet

Tesla: Authorization header leaks on cross-origin redirect via case-sensitive filtering

GHSA-9m9w-gxf7-rh8m CVE-2026-48595 HIGH 18 days ago

### Summary `Tesla.Middleware.FollowRedirects` is meant to strip the `Authorization` header when following a cross-origin redirect, but performs t...

hex

No PRs yet

Tesla has decompression bomb on response body

GHSA-mc85-72gr-vm9f CVE-2026-48594 HIGH 18 days ago

### Summary Any Tesla client pipeline that includes `Tesla.Middleware.DecompressResponse` or `Tesla.Middleware.Compression` eagerly decompresses H...

hex

No PRs yet

Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

GHSA-q7jx-v53g-848w CVE-2026-48596 LOW 18 days ago

### Summary `Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `Content-Type` header with no validation. ...

hex

No PRs yet

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

GHSA-g586-ccqf-7x4r CVE-2026-48862 HIGH 18 days ago

### Summary Mint's HTTP/2 client accepts `PUSH_PROMISE` frames from any server it connects to and inserts every promised stream into a per-connect...

hex

No PRs yet

mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

GHSA-2p26-p43x-fhp8 CVE-2026-49754 HIGH 18 days ago

### Summary Mint's HTTP/2 client accumulates `CONTINUATION` header-block fragments into a per-connection buffer with no cap on size or frame count...

hex

No PRs yet

mint: Content-Length header accepts non-RFC "+" sign prefix

GHSA-mjqx-c6f6-7rc2 CVE-2026-49753 MODERATE 18 days ago

### Summary Mint's HTTP/1 client accepts `Content-Length` header values with a leading `+` sign (e.g. `+0`, `+123`), which RFC 7230 forbids (`Cont...

hex

No PRs yet

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

GHSA-2pg6-44cx-c49v CVE-2026-48861 LOW 18 days ago

### Summary Mint's HTTP/1 request encoder splices the caller-supplied `method` and `target` directly into the request line without character valid...

hex

No PRs yet

Phoenix JavaScript presence client crashes on presence keys colliding with Object.prototype members in Presence.syncState/syncDiff

EEF-CVE-2026-56812 GHSA-63mc-hw7g-86rr CVE-2026-56812 MEDIUM 20 days ago

## Summary Improper Check for Unusual or Exceptional Conditions vulnerability in phoenixframework phoenix (Presence JavaScript client) allows an a...

hex npm

No PRs yet

Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service

EEF-CVE-2026-56811 GHSA-6983-jfq8-485w CVE-2026-56811 HIGH 20 days ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in phoenixframework phoenix (Phoenix.Socket module) allows an unauth...

hex

No PRs yet

Email-derived URL path injection in the Swoosh Microsoft Graph adapter

EEF-CVE-2026-54893 GHSA-754j-98wh-57rf CVE-2026-54893 LOW 21 days ago

## Summary URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by inte...

hex

No PRs yet

mint buffers an entire chunked response chunk in memory in Mint.HTTP1.decode_body/5

EEF-CVE-2026-56810 GHSA-c59h-fq4p-r36r CVE-2026-56810 HIGH 21 days ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint (Mint.HTTP1 module) allows a denial of service v...

hex

No PRs yet

Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax

EEF-CVE-2026-58226 GHSA-jj2p-32j7-whj2 CVE-2026-58226 HIGH 21 days ago

## Summary Inefficient Algorithmic Complexity vulnerability in elixir-mint hpax allows unauthenticated denial-of-service via unbounded HPACK integ...

hex

No PRs yet

QUIC has Broken TLS verification

GHSA-2r8v-p65x-3663 CVE-2026-49457 CRITICAL 26 days ago

### Impact The QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the cert...

hex

No PRs yet

oban_web missing authorization check on `save-job` event handler

GHSA-389x-rgxr-8m33 CVE-2026-48592 MODERATE 27 days ago

### Summary `oban_web` 2.12.0 through the current unpatched release exposes a `save-job` LiveView event handler that performs no authorization che...

hex

No PRs yet

oban_web: Unbounded range expansion in cron describe causes memory exhaustion

GHSA-6xh2-93p9-vqh4 CVE-2026-48593 MODERATE 27 days ago

### Summary `oban_web` 2.12.0 introduced a cron expression parser that expands `-`-separated ranges without validating the endpoints. An attacker ...

hex

No PRs yet

RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API

GHSA-w6cq-9cf4-gqpg CVE-2023-46118 MODERATE 27 days ago

### Summary Responsibly disclosed by @NSEcho. HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very...

hex

No PRs yet

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

GHSA-v9gv-xp36-jgj8 CVE-2022-31008 MODERATE 27 days ago

### Impact Shovel and Federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seed...

hex

No PRs yet

Atom-table exhaustion denial-of-service via JSON parse_document in MDEx

EEF-CVE-2026-53426 GHSA-923r-7vf4-5vw8 CVE-2026-53426 HIGH 28 days ago

## Summary Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.parse\_document...

hex

No PRs yet

Unsanitized URL schemes in MDEx Quill Delta output allow javascript: injection (XSS)

EEF-CVE-2026-54889 GHSA-4383-7xfp-gpph CVE-2026-54889 MEDIUM 28 days ago

## Summary Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scripting via unsan...

hex

No PRs yet

Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex

EEF-CVE-2026-54888 GHSA-3w4f-53g2-f66p CVE-2026-54888 MEDIUM 28 days ago

## Summary Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex converts betwee...

hex

No PRs yet

Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service

EEF-CVE-2026-53429 GHSA-cmvp-gp9f-23xw CVE-2026-53429 MEDIUM 28 days ago

## Summary Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex\_native allows an attacker who controls a r...

hex

No PRs yet

Unbounded memory allocation in highlight_lines range expansion in mdex

EEF-CVE-2026-53428 GHSA-j93q-9cvj-rxfm CVE-2026-53428 MEDIUM 28 days ago

## Summary Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause a denial of ser...

hex

No PRs yet

Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

EEF-CVE-2026-53427 GHSA-v664-pmxr-mxxx CVE-2026-53427 LOW 28 days ago

## Summary Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or r...

hex

No PRs yet

ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass

GHSA-8jgf-23q5-x7xx CVE-2026-47074 HIGH about 1 month ago

### Summary `ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incoming SNS message without valid...

hex

No PRs yet

Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes

GHSA-9653-rcfr-5c62 CVE-2026-47067 HIGH about 1 month ago

### Summary [CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability (CWE-770) in hackney's URL...

hex

No PRs yet

Hackney has unbounded buffer accumulation in WebSocket

GHSA-q8jg-fgj4-fphf CVE-2026-47073 HIGH about 1 month ago

### Summary The WebSocket client in `src/hackney_ws.erl` imposes no upper bound on memory consumption across three distinct code paths. In each ca...

hex

No PRs yet

Hackney has CRLF / header injection in WebSocket upgrade request

GHSA-f9vr-g2g2-x9fg CVE-2026-47072 MODERATE about 1 month ago

### Summary CRLF injection in hackney's WebSocket upgrade request builder (`src/hackney_ws.erl`). `init/1` copies the `host`, `path`, `headers`, a...

hex

No PRs yet

Hackney has CR/LF injection in query parameter

GHSA-j9wq-vxxc-94wf CVE-2026-47075 MODERATE about 1 month ago

### Summary `hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without percent-encoding `\r` or `\n...

hex

No PRs yet

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

GHSA-jq4m-q6p2-8gwc CVE-2026-47077 HIGH about 1 month ago

### Summary `hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory without any size cap. The `a...

hex

No PRs yet

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

GHSA-h73q-4w9q-82h4 CVE-2026-47070 MODERATE about 1 month ago

### Summary The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`, `Cookie`, `Proxy-Authoriza...

hex

No PRs yet

Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host

GHSA-pj7v-xfvx-wmjq CVE-2026-47076 MODERATE about 1 month ago

### Summary `hackney_url:normalize/2` URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist runs before normalization us...

hex

No PRs yet

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

GHSA-mp55-p8c9-rfw2 CVE-2026-47069 LOW about 1 month ago

### Summary CRLF injection in `hackney_cookie:setcookie/3` (`src/hackney_cookie.erl`). The function validates `Name` and `Value` against CR/LF and...

hex

No PRs yet

Hackney: `ssl:connect/2` post-handshake upgrade has no timeout

GHSA-gp9c-pm5m-5cxr CVE-2026-47071 HIGH about 1 month ago

### Summary The SOCKS5 transport in `src/hackney_socks5.erl` correctly applies the caller-supplied timeout to the SOCKS5 negotiation phase, but th...

hex

No PRs yet

Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

GHSA-6cp8-v795-jr2j CVE-2026-47066 HIGH about 1 month ago

### Summary [CVE-2026-47066](https://nvd.nist.gov/vuln/detail/CVE-2026-47066) is an infinite loop (CWE-835) in hackney's Alt-Svc response header p...

hex

No PRs yet

Relyra SAML SignatureValue not cryptographically verified -> authentication bypass

GHSA-jv46-xfwm-36j7 CVE-2026-49454 CRITICAL about 1 month ago

## Summary Relyra `1.0.0` and `1.1.0` accept forged SAML signatures because `SignatureValue` was not cryptographically verified before the library...

hex

No PRs yet