EEF-CVE-2026-119446 Session fixation in the CLI login flow allows an unauthenticated attacker to obtain a user's API token

Summary Session Fixation vulnerability in the CLI login flow in nerves-hub nerveshubweb allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/clisession needs no authentication and returns a polling...

EEF-CVE-2026-120286 Missing authorization in device and deployment group page events allows view-role members to change devices and deployment groups

Summary Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerveshubweb allows an authenticated organization member with the view role to change devices and deployment groups via LiveView events reserved for the manage role. The event handlers that add and...

EEF-CVE-2026-120997 Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role

Summary Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerveshubweb allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The...

EEF-CVE-2026-120730 Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware

Summary Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerveshubweb allows an authenticated user who manages devices in any organization to write into other...

EEF-CVE-2026-120999 Improper authentication lets Google sign-in and confirmation links sign users in to accounts registered with their email address by someone else

Summary Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerveshubweb allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Accounts.updateorcreateuserfromueberauth/1 signs a Google...

EEF-CVE-2026-120295 Incorrect authorization in the devices page bulk move allows view-role members to move devices into another organization and receive its firmware

Summary Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerveshubweb allows an authenticated user with the manage role in one organization and only the view role in another to move devices into the second organization's product via the "Move devices to product"...

EEF-CVE-2026-119613 AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail. AshAi.ToToolError gained an implementation for...

EEF-CVE-2026-71397 Unbounded request body accumulation on streaming RPCs causes memory exhaustion in grpc_server

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpcserver allows unauthenticated attackers to exhaust memory and crash the node via an oversized client-streaming or bidirectional-streaming request body. The streaming read clause of...

EEF-CVE-2026-115701 Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

Summary Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. Once a request has been received in full and its handler is still running, cowboyhttp:parse/2 in...

EEF-CVE-2026-113431 Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

Summary Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowlib allows an unauthenticated remote peer to exhaust the memory of an HTTP/2 endpoint via HPACK-indexed header fields. cowhttp2machine:headersdecode/4 in src/cowhttp2machine.erl decodes every HEADERS block...

EEF-CVE-2026-66294 XML injection in Saxy via unescaped CDATA section terminator

Summary XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', b...

EEF-CVE-2026-66295 Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection

Summary Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between , so neither field is checked against the constraints the XML...

EEF-CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

Summary XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is...

EEF-CVE-2026-119434 Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompressusingddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a very large content size...

EEF-CVE-2026-118391 Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

Summary Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates...

EEF-CVE-2026-110826 AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change

Summary Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ashauthentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password. With applyonpasswordchange? true,...

EEF-CVE-2026-118505 AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

Summary Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ashauthentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce bruteforcestrategy by adding a...

EEF-CVE-2026-119215 AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Summary Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ashauthentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor...

EEF-CVE-2026-117680 jsv treats regex match budget exhaustion as a non-match, bypassing patternProperties and not

Summary Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud jsv allows an unauthenticated remote attacker to bypass schema validation via a string that matches a schema regex only after heavy backtracking...

EEF-CVE-2026-117656 Unverified Sign in with Apple callback parameter can override verified ID token claims

Summary Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via the user parameter of the authorization callback. Apple posts the user's name to the...

EEF-CVE-2026-117645 Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1

Summary Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in phoenixframework phoenixhtml allows an attacker who controls attribute names to inject attributes and script into rendered HTML via Phoenix.HTML.attributesescape/1. attributesescape/1 in...

EEF-CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

Summary Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text befo...

EEF-CVE-2026-97209 Insecure temporary file in mix deps.partition lets a local user execute code in another user's dependency build

Summary Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped partition config file. Partitioned dependency compilation passes the project configuration to each partition VM through a file in a fixed-name directory...

EEF-CVE-2026-115274 Unbounded integer parsing in JSON.decode/1 enables CPU and memory exhaustion denial of service in Elixir

Summary Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated attacker who supplies a JSON document to cause a denial of service through CPU and memory exhaustion. JSON.decode/1 and JSON.decode!/1 convert each integ...

EEF-CVE-2026-109821 Unbounded port parsing in URI.parse/1 enables CPU exhaustion denial of service in Elixir

Summary Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies a URL to cause a denial of service through CPU exhaustion. URI.parse/1 converts the port component with String.tointeger/1 in splitauthority/1...

EEF-CVE-2026-116078 HTTP/2 request bodies made of 1-byte DATA frames amplify memory use in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a request body sent as many 1-byte DATA frames. doreaddata/5 in lib/bandit/http2/stream.ex keeps...

EEF-CVE-2026-109823 Host filesystem path disclosure via DNS rebinding

Summary An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag wi...

EEF-CVE-2026-65630 Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose

Summary Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a...

EEF-CVE-2026-65632 ECDSA signature length is not validated in jose, allowing signature malleability

Summary The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature...

EEF-CVE-2026-65631 erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service

Summary Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public josejwk:frombinary/1 or josejwk:frommap/1 API or...

EEF-CVE-2026-65629 Weak PBKDF2 parameters for password-encrypted private-key export in jose

Summary Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with...

EEF-CVE-2026-65628 Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types

Summary josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Becau...

EEF-CVE-2026-65627 Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in potatosalad jose erlang-jose allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The josejwezip:uncompress/2 function in src/jwe/josejwezip.erl decompresses the DEFLATE-compress...

EEF-CVE-2026-65626 Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose

Summary The pure-Erlang RSAES-PKCS1-v15 decryption in the josejwapkcs1 module is a Bleichenbacher padding oracle. emepkcs1decode/2 returns the recovered message when a decrypted block has valid PKCS1 v1.5 padding a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00...

EEF-CVE-2026-65625 Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose

Summary The pure-Erlang AES-GCM fallback in josejwaaes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the aesgcm, Bits clause of blockdecrypt/4, the incoming tag is guarded only by isbinary/1, with no check on its length. Verification in...

EEF-CVE-2026-97200 Unbounded response body buffering and decompression in hackney

Summary Allocation of Resources Without Limits or Throttling vulnerability in hackneyconn in benoitc hackney allows a malicious HTTP server to exhaust client memory via an oversized or highly compressed response body. hackney:request/5 and hackney:body/1 return the whole response body, and nothin...

EEF-CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

Summary Improper Certificate Validation vulnerability in hackneyssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds partialchain, fun hackneyssl:partialchain/...

EEF-CVE-2026-113440 HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney

Summary Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basicauth and cookie credentials of a request via a same-host redirect to another scheme or port. With followredirect enabled, hackney:followredirect/10 in...

EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney

Summary Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not ...

EEF-CVE-2026-112880 CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney

Summary Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

EEF-CVE-2026-108529 SETTINGS and stream-0 WINDOW_UPDATE frames trigger quadratic work over blocked streams in Bandit

Summary Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOWUPDATE frames. The attacker opens thousands of streams whose responses block on the...

EEF-CVE-2026-110499 Client-chosen HPACK encoder table size is applied uncapped, growing per-connection state with every response in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGSHEADERTABLESIZE. Bandit resizes its HPACK encoder table ...

EEF-CVE-2026-109584 HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit

Summary Improper Handling of Highly Compressed Data Data Amplification vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK...

EEF-CVE-2026-111103 HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Summary Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises...

EEF-CVE-2026-111101 HTTP/1.1 chunked request bodies made of 1-byte chunks amplify memory use in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket....

EEF-CVE-2026-113436 Quadratic bignum parsing of Content-Length and Host port values in Bandit

Summary Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parseinteger/2 in...

EEF-CVE-2026-110314 WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit

Summary Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When ...

EEF-CVE-2026-114213 WebSocket 1-byte continuation frames bypass `max_fragmented_message_size` in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks...

EEF-CVE-2026-114216 Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit

Summary Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. Th...

EEF-CVE-2026-115269 HTTP/2 WINDOW_UPDATE and SETTINGS frames reset the request body read timeout in Bandit

Summary Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOWUPDATE or empty SETTINGS frames sent while a Plug reads the request body...