Elixir-plug vulnerabilities
We track 3 vulnerabilities in Elixir-plug products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 23, 2026.
Latest Elixir-plug vulnerabilities
- 8.7 High severity
plug: Inefficient Algorithmic Complexity
Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded r
- 8.2 High severity
plug: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length
- 7.5 High severity
plug_cowboy: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion. Plug.Cowboy.Conn.conn/1 in lib/plug/cowboy/conn.ex calls String.to_atom/1 on the value retu