CVE-2026-8468: plug_project plug denial of service in multipart header parsing

Executive brief

Plug is a foundational library for building web applications in the Elixir programming language. A vulnerability in how it handles file uploads and form data allows an attacker to crash the server by sending a specially crafted request that consumes all available memory. This can lead to a total service outage for any application using the affected library.

Technical details

The vulnerability exists in the `Plug.Conn.read_part_headers/2` function within `lib/plug/conn.ex`. Unlike its sibling function `read_part_body`, `read_part_headers` fails to enforce the `:length` parameter, leading to unbounded buffer accumulation during the parsing of multipart HTTP headers. An unauthenticated remote attacker can exploit this by sending a crafted `multipart/form-data` request with excessively large headers, leading to memory exhaustion and a Denial of Service (DoS). The issue affects applications using `Plug.Parsers` with the `:multipart` parser or those calling the vulnerable function directly. Patches are available in versions 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.

Affected products

• elixir-plug plug >= 1.4.0, < 1.15.4; >= 1.16.0, < 1.16.3; >= 1.17.0, < 1.17.1; >= 1.18.0, < 1.18.2; >= 1.19.0, < 1.19.2

Timeline

• 2026-05-14: disclosed
• 2026-05-20: advisory

References

• https://api.github.com/users/maennchen
• https://github.com/maennchen
• https://api.github.com/users/maennchen/gists%7B/gist_id%7D
• https://api.github.com/users/maennchen/repos
• https://avatars.githubusercontent.com/u/333918?v=4
• https://api.github.com/users/maennchen/events%7B/privacy%7D