Hex - OSV

EEF-CVE-2026-94194

Hex/mint
github.com/elixir-mint/mint

Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries 3 days ago

Fix available
Severity - 6.3 (Medium)

EEF-CVE-2026-92103

Hex/mint
github.com/elixir-mint/mint

Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size 3 days ago

Fix available
Severity - 6.3 (Medium)

EEF-CVE-2026-91043

Hex/mint
github.com/elixir-mint/mint

HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory 3 days ago

Fix available
Severity - 8.2 (High)

GHSA-vj8p-hp9x-gh47

Hex/mpp

mpp vulnerable to Gas Draining with low gas limit 6 days ago

Fix available
Severity - 8.8 (High)

GHSA-qpxh-ff8m-c62v

Hex/mpp

mpp vulnerable to Gas Draining with access list 6 days ago

Fix available
Severity - 6.9 (Medium)

GHSA-vv77-66rf-pm86

Hex/mpp

mpp vulnerable to Gas Draining with no limit 6 days ago

Fix available
Severity - 8.8 (High)

EEF-CVE-2026-92106

Hex/lazy_html
github.com/dashbitco/lazy_html

lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS 6 days ago

Fix available
Severity - 2.3 (Low)

EEF-CVE-2026-93477

Hex/ash
github.com/ash-project/ash

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash 6 days ago

Fix available
Severity - 5.9 (Medium)

GHSA-f4hc-ppw9-4hhw

Hex/ash

Ash: Private action arguments can be set by user input via string-keyed params and atomic changesets 24 Sep

Fix available
Severity - 5.9 (Medium)

EEF-CVE-2026-91187

Hex/nimble_zta
github.com/dashbitco/nimble_zta

Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy 24 Sep

Fix available
Severity - 9.3 (Critical)

GHSA-j43x-5hjq-rgxf

Hex/plug

Plug: quadratic-time decoding of nested query/body parameters enables denial of service 23 Sep

Fix available
Severity - 8.7 (High)

EEF-CVE-2026-87119

Hex/mpp
github.com/zenhive/mpp

mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed 22 Sep

Fix available
Severity - 8.2 (High)

EEF-CVE-2026-89420

Hex/mpp
github.com/zenhive/mpp

Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free 22 Sep

Fix available
Severity - 7.1 (High)

EEF-CVE-2026-82672

Hex/mint
github.com/elixir-mint/mint

Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections 19 Sep

Fix available
Severity - 6.3 (Medium)

EEF-CVE-2026-86688

Hex/ash_authentication
github.com/team-alembic/ash_authentication

Session id is not renewed on authentication in ash_authentication, allowing session fixation 17 Sep

Fix available
Severity - 7.4 (High)

EEF-CVE-2026-76949

Hex/ash_authentication
github.com/team-alembic/ash_authentication

Remember-me sign-in guard reads a session key that is never written in ash_authentication, allowing session replacement 17 Sep

Fix available
Severity - 9.1 (Critical)

Vulnerabilities