We are in the process of publishing 16 advisories in HTTP.jl all of them fixed in the just-released HTTP.jl 2.4.0. See the SecurityAdvisories.jl repo (Publish HTTP.jl security advisories - Pull Request #549 - JuliaLang/SecurityAdvisories.jl - GitHub) for details. None of these are particularly major by themselves, but as a set they add up, so we recommend all users upgrade as soon as possible.
These issues were detected by a version of Claude Mythos and disclosed to the Julia Security team by Anthropic’s Coordinated Vulnerability Disclosure team. We thank them for their efforts.