plug vulnerabilities

2 known vulnerabilities in plug from Elixir-plug. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  plug: Inefficient Algorithmic Complexity

  CVE-2026-54892Jun 23, 2026Elixir-plug

  Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded r

• 8.2 High severity

  plug: Allocation of Resources Without Limits or Throttling

  CVE-2026-8468May 14, 2026Elixir-plug

  Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length