Jonatan Männchen / EEF

Uncontrolled recursion in elixir-protobuf/protobuf JSON decoding of self-referential messages

Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

beam_mcp: nested tool argument constraints advertised but not enforced

beam_mcp: JSON boolean and null tool arguments reach dispatch as strings

Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping

Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Unbounded integer parsing in the Version module enables CPU and memory exhaustion denial of service

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS