Eric Meadows-Jönsson

Explicit organization scopes survive token refresh after membership ends

OAuth token exchange grants repository scopes for organizations the principal cannot access

httpc does not bound server-supplied numeric header values before integer conversion

eldap does not bound the port component of a referral URL before integer conversion

snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields

uri_string does not bound the port component of a URI before integer conversion

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency