EUVD-2026-38446
GHSA-j43x-5hjq-rgxf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Plug/Phoenix endpoint
-
DeliveryCraft deeply bracketed query body
-
ExploitSend concurrent HTTP requests
-
ExecutionTrigger quadratic decode in Plug.Conn.Query
-
PersistSaturate BEAM schedulers
-
ImpactService becomes unresponsive
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | The target must run Plug 1.15.0 through 1.19.2 and accept HTTP requests whose query strings or application/x-www-form-urlencoded bodies pass through Plug.Conn.Query.decode (the default for any route using Plug.Parsers with :urlencoded, including essentially all Phoenix endpoints). No authentication, no route knowledge, and no user interaction are required, and the default 1,000,000-byte URLENCODED body limit is enough to encode ~333,000 nesting levels. Limiting factors: deployments that have already lowered Plug.Parsers' :length for :urlencoded, or that sit behind a WAF/proxy enforcing tight query-string or body size limits, will reach the quadratic-blowup regime at a much smaller (and possibly tolerable) magnitude. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N rating 8.7 (High) is well-aligned with reality: the attack is remote, unauthenticated, requires no user interaction, and only impacts availability (VA:H, with VC and VI = N). Patch is available from the vendor and exploitation is automatable - a single attacker with modest bandwidth can knock over a Phoenix/Plug service. No EPSS, KEV, or SSVC data was provided in the input, and no public POC is referenced, so real-world exploitation activity is unknown; however, the trigger (a long bracketed query string) is documented in the GHSA advisory and reconstructable from the public commit diff, lowering the barrier to weaponization. Given Plug's role under nearly all Elixir web applications, this should be treated as a real patch-now availability priority rather than a theoretical issue. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a small number of concurrent HTTP POST or GET requests carrying a query string or form body like a[a][a]...[a]=1 with ~333,000 nesting levels, fitting in the default 1 MB body limit. Each request pins a BEAM scheduler in Plug.Conn.Query.decode for minutes, and a handful of parallel requests saturate every scheduler thread, rendering the Phoenix or Plug service unresponsive to all users. The exploit is reconstructable directly from the public patch diff even though no packaged POC was referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Denial of service in Elixir Plug 1.15.0 through 1.19.2 allows unauthenticated remote attackers to saturate BEAM schedulers by sending HTTP requests with deeply nested bracket-style query parameters (e.g. a[a][a]...=1). Plug.Conn.Query.decode/4 exhibits quadratic algorithmic complexity in the number of nesting levels, so a single 1 MB request can produce ~333,000 levels and freeze a Plug-based server for minutes. No public exploit identified at time of analysis, but the trigger is trivial and the upstream fix is already merged across multiple release branches.
RemediationAI
Vendor-released patch: upgrade Plug to 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3 (whichever matches your minor line) - these introduce a hard 32-level nesting cap that raises Plug.Conn.InvalidQueryError, per the GHSA-j43x-5hjq-rgxf advisory and commits c317d08, 9c5d37c, d737eb2, d4e5568, and a61124a in https://github.com/elixir-plug/plug. If upgrading immediately is not possible, lower Plug.Parsers' :length option for the :urlencoded parser well below the 1,000,000-byte default (e.g. 8,000 bytes) to cap the maximum achievable nesting - trade-off: legitimate large form posts will be rejected. As an additional compensating control, configure your reverse proxy (nginx, HAProxy, Cloudflare) to reject query strings or bodies containing an abnormal density of '[' characters or to limit request body size for the URL-encoded content type, accepting that this is a heuristic and may block edge-case legitimate traffic.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Plug is the foundational HTTP connection and middleware library underlying virtually every Elixir web stack, including Phoenix. The affected code in lib/plug/conn/query.ex parses URL query strings and application/x-www-form-urlencoded bodies into nested maps and lists. For each bracketed segment (e.g. a[b][c]), the decoder rebuilds map keys using an ever-growing binary prefix of the original key and hashes the full byte range on every level, producing CWE-407 (Inefficient Algorithmic Complexity) - total cost is O(N^2) in the depth of nesting. Combined with the default Plug.Parsers.URLENCODED 1,000,000-byte body limit, the input can encode hundreds of thousands of nesting levels, monopolizing a BEAM scheduler thread per request. The CPE cpe:2.3:a:elixir-plug:plug:*:*:*:*:* identifies the affected package; the upstream patch (commit c317d08) introduces a hard @max_nesting 32 cap enforced via check_nesting! in both split_keys and assign_split.
Know when Plug gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote unauthenticated HTTP request with no user interaction triggers quadratic decode; only availability is impacted, no confidentiality or integrity loss, no scope change.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
DescriptionCVE.org
Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many bracketed segments such as a[a][a][a]=1, the decoder walks the brackets and, for each of the N levels, performs a map operation keyed on an ever-growing binary prefix of the key, hashing the full byte range at each step. The total decode cost is therefore quadratic in the number of nesting levels.
With the default Plug.Parsers.URLENCODED body limit of 1,000,000 bytes, a single request can carry roughly 333,000 nesting levels and saturate a BEAM scheduler for minutes. A small number of concurrent requests can saturate all schedulers and render a Plug-based server unresponsive. No authentication or knowledge of application routes is required.
This vulnerability is associated with program files lib/plug/conn/query.ex and program routines Plug.Conn.Query.decode/4, Plug.Conn.Query.decode_each/2, Plug.Conn.Query.split_keys/6, Plug.Conn.Query.insert_keys/3, and Plug.Conn.Query.finalize_pointer/2.
This issue affects plug from 1.15.0 before 1.15.5, 1.16.4, 1.17.2, 1.18.3, and 1.19.3.
Executive ViewAI
Elixir Plug versions 1.15.0 through 1.19.2 contain a denial-of-service vulnerability (CVSS 8.7) allowing unauthenticated remote attackers to freeze application servers by sending HTTP requests with deeply nested query parameters. Organizations running affected Plug versions face immediate risk of application unavailability and service disruption lasting minutes per attack. The attack requires only network access and is trivial to execute, making rapid patching critical for all production environments.
Apply vendor patch. Interim mitigations while patches deploy: implement HTTP request size limits (1-10 MB maximum) and rate limiting on incoming requests; configure web application firewall rules to detect and block requests with excessive query parameter nesting depth (>10 levels).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization fu
Memory exhaustion in Elixir Plug 1.4.0 through 1.19.1 allows remote unauthenticated attackers to crash BEAM VM processes
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component,
Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie v
Sensitive-value disclosure in Elixir's plug_crypto library allows a single unauthenticated request carrying a wrong-type
Exploit-DB