Issued CVEs

CVE ID	Title	Packages	Severity	Published
CVE-2026-94206	Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds	Hex / cloak_ecto GitHub / danielberkompas/cloak_ecto Hex / cloak GitHub / danielberkompas/cloak	M 6.3	2026-10-06
CVE-2026-95105	Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping	Hex / cloak GitHub / danielberkompas/cloak	H 8.2	2026-10-06
CVE-2026-94201	Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash	Hex / ash GitHub / ash-project/ash	H 8.2	2026-10-05
CVE-2026-94194	Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries	Hex / mint GitHub / elixir-mint/mint	M 6.3	2026-09-28
CVE-2026-92103	Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size	Hex / mint GitHub / elixir-mint/mint	M 6.3	2026-09-28
CVE-2026-91043	HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory	Hex / mint GitHub / elixir-mint/mint	H 8.2	2026-09-28
CVE-2026-92106	lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS	Hex / lazy_html GitHub / dashbitco/lazy_html	L 2.3	2026-09-25
CVE-2026-93477	Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash	Hex / ash GitHub / ash-project/ash	M 5.9	2026-09-25
CVE-2026-91187	Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy	Hex / nimble_zta GitHub / dashbitco/nimble_zta	C 9.3	2026-09-24
CVE-2026-86698	Refresh tokens accepted as private repository credentials at the CDN	GitHub / hexpm/hexpm	L 2.3	2026-09-22
CVE-2026-87119	mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed	Hex / mpp GitHub / zenhive/mpp	H 8.2	2026-09-22
CVE-2026-89420	Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free	Hex / mpp GitHub / zenhive/mpp	H 7.1	2026-09-22
CVE-2026-65634	Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder	Erlang pkg:otp/asn1 GitHub / erlang/otp	H 8.2	2026-09-22
CVE-2026-68956	SSH daemon allocates unbounded idle session channels, bypassing max_channels	Erlang pkg:otp/ssh GitHub / erlang/otp	H 7.1	2026-09-22
CVE-2026-89422	TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension	Erlang Erlang / ssl GitHub / erlang/otp	C 9.3	2026-09-22
CVE-2026-82672	Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections	Hex / mint GitHub / elixir-mint/mint	M 6.3	2026-09-19
CVE-2026-86688	Session id is not renewed on authentication in ash_authentication, allowing session fixation	Hex / ash_authentication GitHub / team-alembic/ash_authentication	H 7.4	2026-09-17
CVE-2026-76949	Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement	Hex / ash_authentication GitHub / team-alembic/ash_authentication	C 9.1	2026-09-17
CVE-2026-91039	dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover	Hex / ash_authentication GitHub / team-alembic/ash_authentication	C 9.1	2026-09-17
CVE-2026-88952	OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication	Hex / ash_authentication GitHub / team-alembic/ash_authentication	C 9.1	2026-09-17
CVE-2026-85500	`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication	Hex / ash_authentication GitHub / team-alembic/ash_authentication	C 9.1	2026-09-17
CVE-2026-86533	Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix	Hex / ash_authentication GitHub / team-alembic/ash_authentication Hex / ash_authentication_phoenix GitHub / team-alembic/ash_authentication_phoenix	C 9.1	2026-09-17
CVE-2026-81632	Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix	Hex / ash_authentication_phoenix GitHub / team-alembic/ash_authentication_phoenix Hex / ash_authentication GitHub / team-alembic/ash_authentication	H 7.2	2026-09-17
CVE-2026-80218	Sign-in token minted for one resource accepted by another in AshAuthentication	Hex / ash_authentication GitHub / team-alembic/ash_authentication	H 7.6	2026-09-17
CVE-2026-78223	Token revocation record built from unverified JWT claims in AshAuthentication	Hex / ash_authentication GitHub / team-alembic/ash_authentication	M 6.9	2026-09-17

CVE-2026-94206

Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds

Hex / cloak_ecto

GitHub / danielberkompas/cloak_ecto

Hex / cloak

GitHub / danielberkompas/cloak

M 6.3

2026-10-06

CVE-2026-95105

Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping

Hex / cloak

GitHub / danielberkompas/cloak