Skip to content
OpenAdvisories

Vendor

elixir-plug

6 known vulnerabilities.

Products

plug 5 plug_crypto 1 plug_cowboy 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.7
    CVE-2026-54892

    Plug: quadratic-time decoding of nested query/body parameters enables denial of service

    Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded …

    elixir-plug plug plug Hex
  • High 8.2
    CVE-2026-8468

    Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

    Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :lengt…

    elixir-plug plug plug Hex
  • High 8.7
    CVE-2026-32688

    Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy

    Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion. Plug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value ret…

    elixir-plug plug_cowboy plug_cowboy Hex