Jake Howard

HTMLParser quadratic complexity when processing malformed inputs

Potential exposure of private data via case-sensitive Cache-Control directives in UpdateCacheMiddleware

Potential unencrypted email transmission via STARTTLS in the SMTP backend

Potential exposure of private data via whitespace padding in Vary header

Potential SQL injection in column aliases via control characters

Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

Potential denial-of-service vulnerability via repeated headers when using ASGI

Username enumeration through timing difference in mod_wsgi authentication handler