Junglewise Threat Intelligence

CVE-2026-54892: Elixir Plug denial of service in nested parameter decoder

CVE-2026-54892 · Severity: high · CVSS 8.7 · Published 2026-06-23

Executive brief

Plug is a foundational library used by Elixir-based web applications (such as those built with Phoenix) to handle web requests. A flaw in how it processes complex web form data allows an unauthenticated attacker to send a specially crafted request that consumes excessive server resources. This can cause the entire web server to become unresponsive, leading to a total service outage for all users.

Technical details

A denial of service vulnerability exists in Plug's nested-parameter decoder (Plug.Conn.Query.decode/4 and decode_each/2) due to quadratic algorithmic complexity (CWE-407). When parsing query strings or application/x-www-form-urlencoded bodies with deeply nested bracketed keys (e.g., a[b][c]...), the decoder performs redundant map operations and binary hashing at each nesting level. An unauthenticated remote attacker can exploit this by sending a request with approximately 333,000 nesting levels within the default 1MB body limit, saturating BEAM schedulers for several minutes. This renders the server unresponsive to other traffic. The issue is fixed in versions 1.15.5, 1.16.4, 1.17.2, 1.18.3, and 1.19.3 by introducing a maximum nesting depth limit.

Affected products

  • Elixir-Plug Plug 1.15.0 to 1.15.4, 1.16.0 to 1.16.3, 1.17.0 to 1.17.1, 1.18.0 to 1.18.2, 1.19.0 to 1.19.2

Timeline

  • 2026-06-23: disclosed
  • 2026-06-23: patched
  • 2026-06-23: advisory

References