John Downey

nameConstraints DNS bypass via subject CommonName fallback in public_key hostname verification

Non-CA certificate accepted as intermediate issuer in public_key path validation

Insufficient verification of Hex package metadata in Gleam

SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT

Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification

Multipart form body parser bypasses body size limits in wisp

Path Traversal in wisp.serve_static allows arbitrary file read