Skip to content

StringSubstitutor recursive expansion has a cycle check but no fan-out, depth, or size bound - #772

Open
kornys wants to merge 1 commit into
apache:masterfrom
kornys:security/stringsubstitutor-expansion-limits
Open

kornys wants to merge 1 commit into
apache:masterfrom
kornys:security/stringsubstitutor-expansion-limits

Commits

Commits on Sep 18, 2026