Jonatan Männchen

CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint

CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection

Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects

Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression

Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Cookie attribute injection in Plug.Conn.Cookies.encode/2

Phoenix transports do not limit channel joins per connection, enabling process-exhaustion denial of service