https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-34715.htmlhttps://patchthecve.com/cve/CVE-2026-34715.htmlFri, 24 Jul 2026 21:10:00 +0000MEDIUM 5.3: ewe is a Gleam web server. Prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into respohttps://patchthecve.com/cve/CVE-2026-32881.htmlhttps://patchthecve.com/cve/CVE-2026-32881.htmlWed, 17 Jun 2026 10:36:30 +0000MEDIUM 5.3: ewe is a Gleam web server. ewe is a Gleam web server. Versions 0.6.0 through 3.0.4 are vulnerable to authentication bypass or spoofed proxy-trust headers. Chunked transfer encoding trailer handling merges declared trailer fields into req.headers after body parsing, but the denylist only blocks 9 heahttps://patchthecve.com/cve/CVE-2026-32873.htmlhttps://patchthecve.com/cve/CVE-2026-32873.htmlWed, 17 Jun 2026 10:36:29 +0000HIGH 7.5: ewe is a Gleam web server. Versions 0.8.0 through 3.0.4 contain a bug in the handle_trailers function where rejected trailer headers (forbidden or undeclared) cause an infinite loop. When handle_trailers encounters such a trailer, three code paths (lines 520, 523, 526) recurse with the original buff