Issued CVEs

CVE ID	Title	Packages	Severity	Published
CVE-2026-39803	HTTP/1 chunked body reader ignores length cap in bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-05-13
CVE-2026-32687	SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3	Hex / postgrex GitHub / elixir-ecto/postgrex	H 7.5	2026-05-12
CVE-2026-43968	CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1	Hex / cowlib GitHub / ninenines/cowlib	M 6.3	2026-05-11
CVE-2026-7790	Unbounded chunk-size hex digits in cowlib cause quadratic CPU and memory DoS	Hex / cowlib GitHub / ninenines/cowlib	H 8.7	2026-05-11
CVE-2026-43969	Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1	Hex / cowlib GitHub / ninenines/cowlib	L 2.1	2026-05-11
CVE-2026-42793	Atom table exhaustion via attacker-controlled GraphQL SDL names in absinthe	Hex / absinthe GitHub / absinthe-graphql/absinthe	H 8.2	2026-05-08
CVE-2026-42794	Reflected XSS via backslash bypass in GraphiQL js_escape in absinthe_plug	Hex / absinthe_plug GitHub / absinthe-graphql/absinthe_plug	L 2.3	2026-05-08
CVE-2026-43967	Quadratic fragment-name uniqueness check causes denial of service in absinthe	Hex / absinthe GitHub / absinthe-graphql/absinthe	H 8.7	2026-05-08
CVE-2026-32686	Unbounded exponent in decimal enables unauthenticated DoS	Hex / decimal GitHub / ericmj/decimal	M 6.9	2026-05-07
CVE-2026-32689	Long-poll NDJSON body splitting causes unbounded memory allocation in Phoenix	Hex / phoenix GitHub / phoenixframework/phoenix	H 8.7	2026-05-05
CVE-2026-39805	CL.CL HTTP request smuggling via duplicate Content-Length in bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.3	2026-05-01
CVE-2026-39804	WebSocket permessage-deflate inflate has no output-size cap in bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.2	2026-05-01
CVE-2026-39807	Client-supplied URI scheme trusted without transport verification in bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.3	2026-05-01
CVE-2026-42786	WebSocket fragmented message reassembly unbounded in bandit	Hex / bandit GitHub / mtrudel/bandit	H 8.7	2026-05-01
CVE-2026-42788	HTTP/2 frame size limit checked after body is buffered in bandit	Hex / bandit GitHub / mtrudel/bandit	M 6.9	2026-05-01
CVE-2026-32148	Lockfile checksums not verified in Hex allows dependency integrity bypass	Hex Mix Integration GitHub / hexpm/hex	H 8.9	2026-04-30
CVE-2026-32688	Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy	Hex / plug_cowboy GitHub / elixir-plug/plug_cowboy	H 8.7	2026-04-27
CVE-2026-32147	SFTP chroot bypass via path traversal in SSH_FXP_FSETSTAT	Erlang / ssh GitHub / erlang/otp	M 5.3	2026-04-21
CVE-2026-32146	Improper Path Validation in Git Dependency Handling Allows Arbitrary File System Modification	Gleam GitHub / gleam-lang/gleam ghcr.io / gleam-lang/gleam	H 8.3	2026-04-11
CVE-2026-28808	ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)	Erlang Erlang / inets GitHub / erlang/otp	H 8.3	2026-04-07
CVE-2026-32144	OCSP designated-responder authorization bypass via missing signature verification	Erlang / public_key Erlang / ssl GitHub / erlang/otp	H 7.6	2026-04-07
CVE-2026-28810	Predictable DNS Transaction IDs Enable Cache Poisoning in Built-in Resolver	Erlang / kernel GitHub / erlang/otp	M 6.3	2026-04-07
CVE-2026-32145	Multipart form body parser bypasses body size limits in wisp	Hex / wisp GitHub / gleam-wisp/wisp	H 8.7	2026-04-02
CVE-2026-28809	XXE in esaml SAML library allows local file read and potential SSRF	Hex / esaml GitHub / arekinath/esaml GitHub / handnot2/esaml GitHub / dropbox/esaml GitHub / jump-app/esaml	M 6.3	2026-03-23
CVE-2026-23940	Denial of Service via Oversized Package Upload	GitHub / hexpm/hexpm	H 7.1	2026-03-13

CVE-2026-39803

HTTP/1 chunked body reader ignores length cap in bandit

Hex / bandit

GitHub / mtrudel/bandit

H 8.7

2026-05-13

CVE-2026-32687

SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3

Hex / postgrex

GitHub / elixir-ecto/postgrex

H 7.5

2026-05-12