Tesla has CRLF injection in request `Content-Type` header via `add_content_type_param`

CVE-2026-48596

### Summary `Tesla.Multipart.add_content_type_param/2` appends caller-supplied strings to the multipart `Content-Type`

历史摘要 · 未重新核验 · GitHub Advisory

mint: Unbounded streams map growth via PUSH_PROMISE without follow-up HEADERS

CVE-2026-48862

### Summary Mint's HTTP/2 client accepts `PUSH_PROMISE` frames from any server it connects to and inserts every promise

历史摘要 · 未重新核验 · GitHub Advisory

mint: Unbounded CONTINUATION/HEADERS frame accumulation (CONTINUATION flood)

CVE-2026-49754

### Summary Mint's HTTP/2 client accumulates `CONTINUATION` header-block fragments into a per-connection buffer with no

历史摘要 · 未重新核验 · GitHub Advisory

mint: Content-Length header accepts non-RFC "+" sign prefix

CVE-2026-49753

### Summary Mint's HTTP/1 client accepts `Content-Length` header values with a leading `+` sign (e.g. `+0`, `+123`), wh

历史摘要 · 未重新核验 · GitHub Advisory

mint has potential CRLF injection in its HTTP request line via unvalidated `method`/`target`

CVE-2026-48861

### Summary Mint's HTTP/1 request encoder splices the caller-supplied `method` and `target` directly into the request l

历史摘要 · 未重新核验 · GitHub Advisory

QUIC has Broken TLS verification

CVE-2026-49457

### Impact The QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signatur

历史摘要 · 未重新核验 · GitHub Advisory

oban_web missing authorization check on `save-job` event handler

CVE-2026-48592

### Summary `oban_web` 2.12.0 through the current unpatched release exposes a `save-job` LiveView event handler that pe

历史摘要 · 未重新核验 · GitHub Advisory

oban_web: Unbounded range expansion in cron describe causes memory exhaustion

CVE-2026-48593

### Summary `oban_web` 2.12.0 introduced a cron expression parser that expands `-`-separated ranges without validating

历史摘要 · 未重新核验 · GitHub Advisory

ex_aws_sns: Trusted-attacker `SigningCertURL` permits complete SNS signature bypass

### Summary `ExAws.SNS.verify_message/1` fetches the signing certificate from the `SigningCertURL` field of the incomin

历史摘要 · 未重新核验 · GitHub Advisory

Hackney vulnerable to atom-table exhaustion via unrecognized URL schemes

CVE-2026-47067

### Summary [CVE-2026-47067](https://nvd.nist.gov/vuln/detail/CVE-2026-47067) is an atom table exhaustion vulnerability

历史摘要 · 未重新核验 · GitHub Advisory

Hackney has unbounded buffer accumulation in WebSocket

CVE-2026-47073

### Summary The WebSocket client in `src/hackney_ws.erl` imposes no upper bound on memory consumption across three dist

历史摘要 · 未重新核验 · GitHub Advisory

Hackney has CRLF / header injection in WebSocket upgrade request

CVE-2026-47072

### Summary CRLF injection in hackney's WebSocket upgrade request builder (`src/hackney_ws.erl`). `init/1` copies the `

历史摘要 · 未重新核验 · GitHub Advisory

Hackney has CR/LF injection in query parameter

CVE-2026-47075

### Summary `hackney_url:make_url/3` passes the URL query component directly into the HTTP/1.1 request target without p

历史摘要 · 未重新核验 · GitHub Advisory

Hackney: Per-chunk timeout with unbounded body accumulation enables slow-drip OOM

CVE-2026-47074

### Summary `hackney_h3:await_response_loop/6` in `src/hackney_h3.erl` accumulates the HTTP/3 response body in memory w

历史摘要 · 未重新核验 · GitHub Advisory

Hackney: Cross-origin Redirect Leaks Authorization, Cookie, and Request Body

CVE-2026-47070

### Summary The HTTP/3 redirect handler in `src/hackney_h3.erl` forwards the original request headers (`Authorization`,

历史摘要 · 未重新核验 · GitHub Advisory

Hackney has SSRF allowlist bypass in hackney_url:normalize/2 via percent-encoded host

CVE-2026-47076

### Summary `hackney_url:normalize/2` URL-decodes the host component of a parsed URL, but the caller's SSRF allowlist r

历史摘要 · 未重新核验 · GitHub Advisory

Hackney has CRLF / header injection via unvalidated `domain` and `path` options

CVE-2026-47069

### Summary CRLF injection in `hackney_cookie:setcookie/3` (`src/hackney_cookie.erl`). The function validates `Name` an

历史摘要 · 未重新核验 · GitHub Advisory

Hackney: `ssl:connect/2` post-handshake upgrade has no timeout

CVE-2026-47071

### Summary The SOCKS5 transport in `src/hackney_socks5.erl` correctly applies the caller-supplied timeout to the SOCKS

历史摘要 · 未重新核验 · GitHub Advisory

Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

CVE-2026-47066

### Summary [CVE-2026-47066](https://nvd.nist.gov/vuln/detail/CVE-2026-47066) is an infinite loop (CWE-835) in hackney'

历史摘要 · 未重新核验 · GitHub Advisory

PhoenixStorybook has cross-session PubSub topic injection via URL parameter

CVE-2026-47068

### Summary The storybook iframe LiveView accepts a PubSub topic from the URL query string and broadcasts its own pid on

历史摘要 · 未重新核验 · GitHub Advisory