Hex Advisories.

Uncontrolled recursion over deeply nested Markdown crashes the BEAM in mdex

• Denial of service

>=0.3.0, <0.12.3 · fixed in 0.12.3

Unbounded native memory leak in mdex escaped-tag rendering enables unauthenticated denial of service

• Denial of service

>=0.11.0, <0.12.3 · fixed in 0.12.3

Unbounded memory allocation in highlight_lines range expansion in mdex

• Denial of service

>=0.11.0, <0.12.3 · fixed in 0.12.3

Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute

• Cross-site scripting (XSS)

>=0.11.3, <0.12.3 · fixed in 0.12.3

Relyra SAML SignatureValue not cryptographically verified -> authentication bypass

• Authentication bypass
• Weak cryptography or TLS

>=1.0.0, <1.2.0 · fixed in 1.2.0

Stored XSS via unescaped HTML attribute values in earmark

• Cross-site scripting (XSS)

>=1.4.1 · no fixed version yet

Remote code execution and denial of service via unsafe Erlang term deserialization in elixir-grpc/grpc

• Insecure deserialization
• Denial of service

>=0.4.0, <1.0.0 · fixed in 1.0.0

Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding

• Broken access control

>=0.8.0, <1.0.0 · fixed in 1.0.0

Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

• Denial of service

>=0.3.0-alpha.2, <1.0.0 · fixed in 1.0.0

HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2

• Other injection

>=2.9.0 · no fixed version yet

Decompression bomb DoS in Req via auto-decoded archive and compressed response bodies

• CWE-409

>=0.1.0, <0.6.1 · fixed in 0.6.1

Multipart form-data header injection in Req via unescaped name/filename/content_type

• Other injection

>=0.5.3, <0.6.0 · fixed in 0.6.0

gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustion

• Denial of service

>=1.0.0, <2.4.0 · fixed in 2.4.0

gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injection

• CWE-346

>=2.0.0, <2.4.0 · fixed in 2.4.0

gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOM

• CWE-841

>=2.0.0, <2.4.0 · fixed in 2.4.0

CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

• Other injection

>=0.8.0, <1.18.3 · fixed in 1.18.3

Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression

• CWE-409

>=0.6.0, <1.18.3 · fixed in 1.18.3

Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects

• CWE-178

>=1.4.0, <1.18.3 · fixed in 1.18.3

Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint

• Denial of service

>=1.3.0, <1.18.3 · fixed in 1.18.3

CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection

• CWE-116

>=0.8.0, <1.18.3 · fixed in 1.18.3

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

• HTTP request smuggling

>=0.1.0, <1.9.0 · fixed in 1.9.0

HTTP/2 CONTINUATION flood in Mint client via unbounded header-block accumulation

• Denial of service

>=0.1.0, <1.9.0 · fixed in 1.9.0

Unbounded conn.streams growth in Mint HTTP/2 client via unenforced PUSH_PROMISE concurrency

• Denial of service

>=0.2.0, <1.9.0 · fixed in 1.9.0

CRLF injection in HTTP/1 request line via unvalidated method in Mint

• Other injection

>=0.1.0, <1.9.0 · fixed in 1.9.0

ex_aws_sns SigningCertURL not validated in verify_message/1

• Weak cryptography or TLS

>=2.0.1, <2.3.5 · fixed in 2.3.5

Missing authorization check on save-job event handler in oban_web

• Broken access control

>=2.12.0, <2.12.5 · fixed in 2.12.5

Unbounded range expansion in cron describe causes memory exhaustion in oban_web

• Denial of service

>=2.12.0, <2.12.5 · fixed in 2.12.5

Duplicate Advisory: Hackney has an Allocation of Resources Without Limits or Throttling vulnerabilit

• Denial of service

>=2.0.0, <4.0.1 · fixed in 4.0.1

Unbounded memory consumption in WebSocket client in hackney

• Denial of service

>=2.0.0, <4.0.1 · fixed in 4.0.1

Atom table exhaustion via unrecognized URL schemes in hackney

• Denial of service

>=2.0.0, <4.0.1 · fixed in 4.0.1

CRLF injection in WebSocket upgrade request in hackney

• Other injection

>=2.0.0, <4.0.1 · fixed in 4.0.1

SSRF allowlist bypass via percent-encoded host in hackney

• Server-side request forgery (SSRF)
• CWE-436

>=0.13.0, <4.0.1 · fixed in 4.0.1

HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackney

• Open redirect

>=3.1.1, <4.0.1 · fixed in 4.0.1

CR/LF injection in query parameter in hackney

• Other injection

>=0.13.1, <4.0.1 · fixed in 4.0.1

Unbounded body accumulation in HTTP/3 response loop in hackney

• Denial of service

>=2.0.0, <4.0.1 · fixed in 4.0.1

SOCKS5 TLS upgrade ignores caller timeout in hackney

• Denial of service

>=0.10.0, <4.0.1 · fixed in 4.0.1

Infinite loop in Alt-Svc header parser in hackney

• Denial of service

>=2.0.0-beta.1, <4.0.1 · fixed in 4.0.1

CRLF injection in cookie domain/path options in hackney

• Other injection

>=0.9.0, <4.0.1 · fixed in 4.0.1

Cross-session PubSub topic injection via URL parameter in phoenix_storybook

• Broken access control

>=0.4.0, <1.1.0 · fixed in 1.1.0

Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

• Code injection

>=0.5.0, <1.1.0 · fixed in 1.1.0

Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook

• Denial of service

>=0.2.0, <1.1.0 · fixed in 1.1.0

Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

• Denial of service

>=1.4.0, <1.15.4 || >=1.16.0, <1.16.3 || >=1.17.0, <1.17.1 || >=1.18.0, <1.18.2 || >=1.19.0, <1.19.2 · fixed in 1.15.4, 1.16.3, 1.17.1, 1.18.2, 1.19.2

Decompression Bomb in cow_spdy:inflate/2 Allows Memory Exhaustion via Crafted SPDY Frame

• CWE-409

>=0.1.0, <2.16.1 · fixed in 2.16.1

Unbounded buffer accumulation in multipart header parsing causes denial of service in cowboy

• Denial of service

>=2.0.0, <2.15.0 · fixed in 2.15.0

HTTP/1 chunked decoder infinite loop on requests with trailer fields in bandit

• Denial of service

>=1.6.1, <1.11.1 · fixed in 1.11.1

HTTP/1 chunked body reader ignores length cap in bandit

• Denial of service

>=1.4.0, <1.11.1 · fixed in 1.11.1

SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3

• SQL injection

>=0.16.0, <0.22.2 · fixed in 0.22.2

CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

• Other injection

>=2.6.0, <2.16.1 · fixed in 2.16.1

Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS

• Denial of service

>=0.6.0, <2.16.1 · fixed in 2.16.1

Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

• Other injection

>=2.9.0, <2.21.0 · fixed in 2.21.0

ex_webrtc client-role handshake is missing DTLS peer fingerprint validation

• Weak cryptography or TLS

<0.15.1 || >=0.16.0, <0.16.1 · fixed in 0.15.1, 0.16.1

Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe

• Denial of service

>=1.5.0, <1.10.2 · fixed in 1.10.2

Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug

• Cross-site scripting (XSS)

>=1.2.0, <1.5.10 · fixed in 1.5.10

Quadratic fragment-name uniqueness check causes denial of service in absinthe

• Denial of service

>=1.2.0, <1.10.2 · fixed in 1.10.2

Unbounded exponent in decimal enables unauthenticated DoS

• Denial of service

>=0.1.0, <3.0.0 · fixed in 3.0.0

Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix

• Denial of service

>=1.7.0, <1.7.22 || >=1.8.0, <1.8.6 · fixed in 1.7.22, 1.8.6

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

• HTTP request smuggling

>=0.1.0, <1.11.0 · fixed in 1.11.0

WebSocket permessage-deflate inflate has no output-size cap in bandit

• Denial of service

>=0.5.9, <1.11.0 · fixed in 1.11.0

Client-supplied URI scheme trusted without transport verification in bandit

• CWE-807

>=1.0.0, <1.11.0 · fixed in 1.11.0

WebSocket fragmented message reassembly unbounded in bandit

• Denial of service

>=0.5.0, <1.11.0 · fixed in 1.11.0