Ecosystem
Hex
355 known vulnerabilities.
Most affected packages
355 results · Feed
-
High 8.2
Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read c…
-
High 8.2
Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cow…
-
High 8.7
Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cow_http2_machine:headers_decode/4 in src/cow_http2_machi…
-
Low 2.1
XML injection in Saxy via unescaped CDATA section terminator
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between <![CDATA[ and ]]> and passing the payload through byte for byte. The encoder's character-data and attribute-value pa…
-
Low 2.1
Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection
Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between <? and ?>, so neither field is checked ag…
-
Low 2.1
XML comment injection in Saxy encoder via unescaped double hyphen
XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an in…
-
Medium 6.9
Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a ve…
-
High 8.9
Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where …
-
Medium 6.3
AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change
Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With apply_on_passwo…
-
Medium 6.3
AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource
Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ash_authentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce brute_fo…
-
High 7.6
AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuth…
-
Low 2.1
jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not
Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtra…
-
Critical 9.3
Unverified Sign in with Apple callback parameter can override verified ID token claims
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple pos…
-
Medium 5.3
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework phoenix_html allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributes_…
-
Critical 9.1
ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hos…
-
High 8.7
HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. do_read_data/5 in lib…
-
Low 2.3
Host filesystem path disclosure via DNS rebinding
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address…
-
Medium 5.9
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over t…
-
Medium 5.1
ECDSA signature length is not validated in jose, allowing signature malleability
The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (s…
-
Medium 6.9
erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public jose_jwk:from_bina…
-
High 7.4
Weak PBKDF2 parameters for password-encrypted private-key export in jose
Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypt…
-
Medium 5.9
Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itself as shar…
-
Medium 6.9
Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip…
-
Medium 5.9
Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string of at lea…
-
Medium 5.9
Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on …
-
High 8.2
Unbounded response body buffering and decompression in hackney
Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the …
-
Critical 9.1
Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney
Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_ch…
-
Medium 6.0
HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney…
-
Medium 6.9
SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D (decoding to [::fff…
-
Low 2.1
CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an …
-
High 8.7
SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOW_UPDATE frames. The attacker opens thousands of stream…
-
High 8.7
Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGS_HEADER_TABLE_SIZE. Bandit…
-
High 8.7
HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one l…
-
High 8.2
HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit
Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream erro…
-
High 8.7
HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked read…
-
High 8.7
Quadratic bignum parsing of Content-Length and Host port values in Bandit
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers…
-
Medium 6.3
WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit
Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring t…
-
High 8.7
WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Band…
-
Medium 6.3
Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk exten…
-
High 8.7
HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit
Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOW_UPDATE or empty SETTINGS frames sent while a…