Non-responsive delegation: CPU exhaustion in Unbound and BIND 9 resolvers
The referral cap everyone added after NXNSAttack turns into a loop when the nameservers exist but never answer.
found by Yehuda Afek, Anat Bremler-Barr and Shani Stajnrod
protocol-confusion
Namespace separator injection in libexpat (CVE-2022-25236)
libexpat packed three strings into one buffer with a delimiter you chose, and never checked whether the delimiter turned up in the data.
found by Ivan Fratric, Google Project Zero
Smuggling requests past HAProxy with a vertical tab in Transfer-Encoding
How a vertical tab in a Transfer-Encoding header made HAProxy and its backend disagree about where a request ended, opening an HTTP request smuggle.
found by Nathan Davison (independent)