Plug
Monthly
Denial of service in Elixir Plug 1.15.0 through 1.19.2 allows unauthenticated remote attackers to saturate BEAM schedulers by sending HTTP requests with deeply nested bracket-style query parameters (e.g. a[a][a]...=1). Plug.Conn.Query.decode/4 exhibits quadratic algorithmic complexity in the number of nesting levels, so a single 1 MB request can produce ~333,000 levels and freeze a Plug-based server for minutes. No public exploit identified at time of analysis, but the trigger is trivial and the upstream fix is already merged across multiple release branches.
Memory exhaustion in Elixir Plug 1.4.0 through 1.19.1 allows remote unauthenticated attackers to crash BEAM VM processes via unbounded buffer accumulation during multipart/form-data header parsing. The vulnerability mirrors CVE-2026-8466 in Cowboy: read_part_headers/2 recursively accumulates incoming bytes without size limits when parsing malformed multipart requests that never deliver complete header sections. Vendor-released patches available for all affected branches. No public exploit identified at time of analysis, but exploitation requires only basic HTTP client tools.
Sensitive-value disclosure in Elixir's plug_crypto library allows a single unauthenticated request carrying a wrong-typed argument or a missing header to push the application's secret key base, a derived 32-byte encryption key, or the configured secret an API key is compared against into the Plug.Cowboy/Bandit error log and into crash_reason Logger metadata that error trackers forward. Applications on plug_crypto from 1.0.0 before 2.2.1, or on the bundled Plug.Crypto shipped in plug from 1.6.3 before 1.7.0, are affected; the request itself does not hand the secret to the attacker, so exploitation additionally depends on a separate party having read access to those logs or to the error tracker, which is why the assessed vector carries PR:H despite the unauthenticated trigger. No public exploit code was identified at time of analysis, and patched releases (plug_crypto 2.2.1, plug 1.7.0) are available from the vendor.
Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Denial of service in Elixir Plug 1.15.0 through 1.19.2 allows unauthenticated remote attackers to saturate BEAM schedulers by sending HTTP requests with deeply nested bracket-style query parameters (e.g. a[a][a]...=1). Plug.Conn.Query.decode/4 exhibits quadratic algorithmic complexity in the number of nesting levels, so a single 1 MB request can produce ~333,000 levels and freeze a Plug-based server for minutes. No public exploit identified at time of analysis, but the trigger is trivial and the upstream fix is already merged across multiple release branches.
Memory exhaustion in Elixir Plug 1.4.0 through 1.19.1 allows remote unauthenticated attackers to crash BEAM VM processes via unbounded buffer accumulation during multipart/form-data header parsing. The vulnerability mirrors CVE-2026-8466 in Cowboy: read_part_headers/2 recursively accumulates incoming bytes without size limits when parsing malformed multipart requests that never deliver complete header sections. Vendor-released patches available for all affected branches. No public exploit identified at time of analysis, but exploitation requires only basic HTTP client tools.
Sensitive-value disclosure in Elixir's plug_crypto library allows a single unauthenticated request carrying a wrong-typed argument or a missing header to push the application's secret key base, a derived 32-byte encryption key, or the configured secret an API key is compared against into the Plug.Cowboy/Bandit error log and into crash_reason Logger metadata that error trackers forward. Applications on plug_crypto from 1.0.0 before 2.2.1, or on the bundled Plug.Crypto shipped in plug from 1.6.3 before 1.7.0, are affected; the request itself does not hand the secret to the attacker, so exploitation additionally depends on a separate party having read access to those logs or to the error tracker, which is why the assessed vector carries PR:H despite the unauthenticated trigger. No public exploit code was identified at time of analysis, and patched releases (plug_crypto 2.2.1, plug 1.7.0) are available from the vendor.
Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.