EUVD-2026-38446Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated HTTP request with no user interaction triggers quadratic decode; only availability is impacted, no confidentiality or integrity loss, no scope change.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many bracketed segments such as a[a][a][a]=1, the decoder walks the brackets and, for each of the N levels, performs a map operation keyed on an ever-growing binary prefix of the key, hashing the full byte range at each step. The total decode cost is therefore quadratic in the number of nesting levels.
With the default Plug.Parsers.URLENCODED body limit of 1,000,000 bytes, a single request can carry roughly 333,000 nesting levels and saturate a BEAM scheduler for minutes. A small number of concurrent requests can saturate all schedulers and render a Plug-based server unresponsive. No authentication or knowledge of application routes is required.
This vulnerability is associated with program files lib/plug/conn/query.ex and program routines Plug.Conn.Query.decode/4, Plug.Conn.Query.decode_each/2, Plug.Conn.Query.split_keys/6, Plug.Conn.Query.insert_keys/3, and Plug.Conn.Query.finalize_pointer/2.
This issue affects plug from 1.15.0 before 1.15.5, 1.16.4, 1.17.2, 1.18.3, and 1.19.3.
AnalysisAI
Denial of service in Elixir Plug 1.15.0 through 1.19.2 allows unauthenticated remote attackers to saturate BEAM schedulers by sending HTTP requests with deeply nested bracket-style query parameters (e.g. a[a][a]...=1). Plug.Conn.Query.decode/4 exhibits quadratic algorithmic complexity in the number of nesting levels, so a single 1 MB request can produce ~333,000 levels and freeze a Plug-based server for minutes. No public exploit identified at time of analysis, but the trigger is trivial and the upstream fix is already merged across multiple release branches.
Technical ContextAI
Plug is the foundational HTTP connection and middleware library underlying virtually every Elixir web stack, including Phoenix. The affected code in lib/plug/conn/query.ex parses URL query strings and application/x-www-form-urlencoded bodies into nested maps and lists. For each bracketed segment (e.g. a[b][c]), the decoder rebuilds map keys using an ever-growing binary prefix of the original key and hashes the full byte range on every level, producing CWE-407 (Inefficient Algorithmic Complexity) - total cost is O(N^2) in the depth of nesting. Combined with the default Plug.Parsers.URLENCODED 1,000,000-byte body limit, the input can encode hundreds of thousands of nesting levels, monopolizing a BEAM scheduler thread per request. The CPE cpe:2.3:a:elixir-plug:plug:*:*:*:*:* identifies the affected package; the upstream patch (commit c317d08) introduces a hard @max_nesting 32 cap enforced via check_nesting! in both split_keys and assign_split.
RemediationAI
Vendor-released patch: upgrade Plug to 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3 (whichever matches your minor line) - these introduce a hard 32-level nesting cap that raises Plug.Conn.InvalidQueryError, per the GHSA-j43x-5hjq-rgxf advisory and commits c317d08, 9c5d37c, d737eb2, d4e5568, and a61124a in https://github.com/elixir-plug/plug. If upgrading immediately is not possible, lower Plug.Parsers' :length option for the :urlencoded parser well below the 1,000,000-byte default (e.g. 8,000 bytes) to cap the maximum achievable nesting - trade-off: legitimate large form posts will be rejected. As an additional compensating control, configure your reverse proxy (nginx, HAProxy, Cloudflare) to reject query strings or bodies containing an abnormal density of '[' characters or to limit request body size for the URL-encoded content type, accepting that this is a heuristic and may block edge-case legitimate traffic.
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization fu
Memory exhaustion in Elixir Plug 1.4.0 through 1.19.1 allows remote unauthenticated attackers to crash BEAM VM processes
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component,
Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie v
Same weakness CWE-407 – Inefficient Algorithmic Complexity
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today