Skip to content
OpenAdvisories

Package · Hex

plug

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.7
    CVE-2026-54892

    Plug: quadratic-time decoding of nested query/body parameters enables denial of service

    Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded …

    elixir-plug plug plug Hex
  • High 8.2
    CVE-2026-8468

    Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

    Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :lengt…

    elixir-plug plug plug Hex
  • High 8.1
    CVE-2017-1000053

    Arbitrary Code Execution in Cookie Serialization

    Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.

    plug Hex
  • High 7.8
    CVE-2017-1000052

    Null Byte Injection in Plug.Static

    Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

    plug Hex