Yordis Prieto

CRLF injection in Tesla.Multipart.add_content_type_param/2 allows HTTP header injection

Atom table exhaustion via untrusted URL scheme in Tesla.Adapter.Mint

CRLF injection in Tesla.Multipart disposition parameters allows multipart part header injection

Authorization header leaks to third-party origin on cross-origin redirect in Tesla.Middleware.FollowRedirects

Decompression bomb in Tesla.Middleware.DecompressResponse and Tesla.Middleware.Compression

Atom-table exhaustion denial of service in Guardian via unbounded atom creation from binary keys

Atom-table exhaustion denial of service in Guardian permissions AtomEncoding via unbounded atom creation

guardian atom exhaustion in Guardian.Permissions.encode_permissions!/1

Guardian.revoke/3 acts on unverified token claims, allowing forged-token session revocation