Skip to content
OpenAdvisories

Vendor

elixir-plug

6 known vulnerabilities.

elixir-plug at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 1 vulnerability June 2026: 1 vulnerability Jun July 2026: 2 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 1 vulnerability November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202610
Sep 202600
Aug 202600
Jul 202620
Jun 202610
May 202610
Apr 202610
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

plug 5 plug_crypto 1 plug_cowboy 1
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 5.1
    CVE-2026-105963

    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

    Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-typed argument. Every publ…

    elixir-plug plug plug_crypto plug Ubuntu Hex
  • Low 2.1
    CVE-2026-56813

    Cookie attribute injection in Plug.Conn.Cookies.encode/2

    Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response head…

    elixir-plug plug plug Hex
  • Medium 6.9
    CVE-2026-56814

    Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

    Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser c…

    elixir-plug plug plug Hex
  • High 8.7
    CVE-2026-54892

    Plug: quadratic-time decoding of nested query/body parameters enables denial of service

    Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded …

    elixir-plug plug plug Hex
  • High 8.2
    CVE-2026-8468

    Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

    Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :lengt…

    elixir-plug plug plug Hex
  • High 8.7
    CVE-2026-32688

    Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy

    Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion. Plug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value ret…

    elixir-plug plug_cowboy plug_cowboy Hex