Hex Advisories.

Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries

• HTTP request smuggling

>=0.1.0, <1.10.2 · fixed in 1.10.2

Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size

• Denial of service

>=0.1.0, <1.10.2 · fixed in 1.10.2

HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory

• Denial of service

>=1.1.0, <1.10.2 · fixed in 1.10.2

mpp vulnerable to Gas Draining with low gas limit

• CWE-20
• CWE-1284

>=0.2.0, <0.6.0 · fixed in 0.6.0

mpp vulnerable to Gas Draining with access list

• CWE-20
• CWE-1284

>=0.2.0, <0.6.0 · fixed in 0.6.0

mpp vulnerable to Gas Draining with no limit

• CWE-20
• CWE-1284

>=0.2.0, <0.6.0 · fixed in 0.6.0

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS

• Cross-site scripting (XSS)

>=0.1.0, <0.1.13 · fixed in 0.1.13

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

• Broken access control

>=2.17.15, <3.33.11 · fixed in 3.33.11

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets

• Broken access control

>=3.0.0, <3.29.3 · fixed in 3.29.3

Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

• Weak cryptography or TLS

>=0.1.2, <0.1.3 · fixed in 0.1.3

Plug: quadratic-time decoding of nested query/body parameters enables denial of service

• Denial of service

>=1.15.0, <1.15.5 || >=1.16.0, <1.16.4 || >=1.17.0, <1.17.2 || >=1.18.0, <1.18.3 || >=1.19.0, <1.19.3 · fixed in 1.15.5, 1.16.4, 1.17.2, 1.18.3, 1.19.3

mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed

• Authentication bypass

>=0.14.0, <0.16.2 · fixed in 0.16.2

Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free

• CWE-1284

>=0.14.0, <0.16.2 · fixed in 0.16.2

Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

• HTTP request smuggling

>=0.1.0, <1.10.1 · fixed in 1.10.1

Session id is not renewed on authentication in ash_authentication, allowing session fixation

• Authentication bypass

>=0.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement

• Authentication bypass

>=4.10.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

• Authentication bypass

>=5.0.0-rc.10, <5.0.0-rc.14 · fixed in 5.0.0-rc.14

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

• Authentication bypass

>=4.14.0, <4.15.0 || >=5.0.0-rc.10, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication

• CWE-305

>=4.3.8, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix

• Authentication bypass

>=4.9.1, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix

• CWE-598

>=3.10.5, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Sign-in token minted for one resource accepted by another in AshAuthentication

• Authentication bypass

>=3.10.5, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Token revocation record built from unverified JWT claims in AshAuthentication

• Weak cryptography or TLS

>=0.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Log injection via an unescaped password reset identity in AshAuthentication

• Other injection

>=4.2.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Replayable OAuth2 CSRF state retained after a failed callback in AshAuthentication

• Authentication bypass

>=0.6.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Magic link single-use tokens replayable via TOCTOU race in AshAuthentication

• Race condition

>=3.9.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Confirmation token accepted on any record in AshAuthentication

• Broken access control

>=0.5.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in

• Denial of service

>=4.8.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Reversible IP address pseudonymisation in AshAuthentication audit log hash mode

• CWE-760

>=4.12.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.14 · fixed in 4.15.0, 5.0.0-rc.14

Actor record with password digest stored in AshAuthentication audit log entries

• Information disclosure

>=4.12.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.2 · fixed in 4.15.0, 5.0.0-rc.2

Ash field policies do not filter-nil forbidden calculations and aggregates, enabling an information-disclosure oracle

• CWE-1220

>=2.11.0-rc.0, <3.33.4 · fixed in 3.33.4

mpp Tempo keys its pre-broadcast dedup reserve on the caller-supplied transaction encoding, so a re-encoded signed transaction reserves a second slot

• CWE-1289

>=0.2.0, <0.16.2 · fixed in 0.16.2

mpp writes Payment-Receipt and Cache-Control before the wrapped application runs, letting a consumer's own Cache-Control expose paid responses to shared caches

• CWE-524

>=0.1.0, <0.16.2 · fixed in 0.16.2

SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

• Server-side request forgery (SSRF)
• CWE-636

>=0.1.0 · no fixed version yet

safeurl validated address is not bound to the request, allowing DNS rebinding

• Race condition

>=0.1.0 · no fixed version yet

AshLua eval read operations can read field-policy-protected fields via aggregates

• CWE-1220

>=0.1.0, <0.2.2 · fixed in 0.2.2

AshAi aggregate tool can read field-policy-protected fields

• CWE-1220

>=0.1.0, <1.0.3 · fixed in 1.0.3

Terminal escape sequence injection in mix usage_rules.search_docs via package documentation metadata

• CWE-150

>=0.1.18, <1.2.8 · fixed in 1.2.8

Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

• CWE-150

>=0.8.1, <0.8.4 · fixed in 0.8.4

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

• CWE-424

>=0.1.0, <0.2.1 · fixed in 0.2.1

Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

• CWE-173

>=0.1.0, <1.0.19 · fixed in 1.0.19

ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the gated Dynamic Client Registration endpoint

• Authentication bypass

>=0.1.0, <0.3.1 · fixed in 0.3.1

ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addresses as public, allowing SSRF

• Server-side request forgery (SSRF)

>=0.3.0, <0.3.1 · fixed in 0.3.1

ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

• CWE-116

>=0.1.3, <0.3.1 · fixed in 0.3.1

ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

• CWE-524

>=0.1.3, <0.3.1 · fixed in 0.3.1

ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

• CWE-424

>=0.1.0, <0.3.1 · fixed in 0.3.1

Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and cache entries in ash_authentication_oauth2_server

• Denial of service

>=0.3.0, <0.3.1 · fixed in 0.3.1

Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation

• CWE-1284

>=0.2.0, <0.16.1 · fixed in 0.16.1

Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning

• CWE-1284

>=0.2.0, <0.16.1 · fixed in 0.16.1

Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length

• CWE-1284

>=0.10.0, <3.33.0 · fixed in 3.33.0

Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS

• Denial of service

>=0.1.0, <1.10.0 · fixed in 1.10.0

Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

• Denial of service

>=1.9.3, <1.10.0 · fixed in 1.10.0

Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor

• Broken access control

>=3.4.44, <3.32.2 · fixed in 3.32.2

Ash relationship parent(...) filter degrades to an IS NULL match when the parent field is unresolved, leaking scoped records

• Broken access control

>=3.13.2, <3.32.2 · fixed in 3.32.2

Ash.Actions.Aggregate authorizes an aggregate under one action but computes it under another

• Broken access control

>=3.5.13, <3.32.2 · fixed in 3.32.2

Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records

• Broken access control

>=3.29.0, <3.32.2 · fixed in 3.32.2

ETS and Mnesia data layers overwrite an existing record on create instead of enforcing primary-key uniqueness

• Broken access control

>=0.4.0, <3.32.2 · fixed in 3.32.2

Ash.Reactor change step fails open, skipping a change when its where guard raises

• CWE-636

>=3.0.0-rc.17, <3.32.2 · fixed in 3.32.2

Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads

• Denial of service

>=2.19.0, <3.32.2 · fixed in 3.32.2

Ash.Filter.Runtime materializes a combinatorial cross-product over to-many relationships, exhausting memory

• Denial of service

>=1.29.0-rc0, <3.32.2 · fixed in 3.32.2