Jonatan Männchen / EEF

HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

Path traversal in Gleam via unvalidated package application names

hex_core decompresses registry and Erlang term API responses without size limits

Path traversal in rebar3 via unvalidated dependency app names

Path traversal in Hex via unvalidated dependency app names

Hex release-age cooldown is lifted package-wide when the locked release is retired

Hex writes unverified package tarballs to standard output in mix hex.package fetch

Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror

Hex trusts its bundled CA certificates when cacerts_path is set

hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25