Read the docs
TI-2026-07437 Aliases CVE-2026-8468GHSA-468c-vq7p-gh64

Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

Priority LOW 37CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service. This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0062 49th percentileScored 2026-11-07
Fix Fixed plug (elixir-plug): 1.15.4, 1.16.3, 1.17.1 +2plug (Hex): 1.15.4, 1.16.3, 1.17.1 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elixir-plugplug1.4.0 to before 1.15.4; 1.16.0 to before 1.16.3; 1.17.0 to before 1.17.1; 1.18.0 to before 1.18.2; 1.19.0 to before 1.19.21.15.4, 1.16.3, 1.17.1, 1.18.2, 1.19.2Patch availableCNA
—plug (Hex)1.4.0 to before 1.15.41.15.4Patch availableGHSA-468c-vq7p-gh64
—plug (Hex)1.16.0 to before 1.16.31.16.3Patch availableGHSA-468c-vq7p-gh64
—plug (Hex)1.17.0 to before 1.17.11.17.1Patch availableGHSA-468c-vq7p-gh64
—plug (Hex)1.18.0 to before 1.18.21.18.2Patch availableGHSA-468c-vq7p-gh64
—plug (Hex)1.19.0 to before 1.19.21.19.2Patch availableGHSA-468c-vq7p-gh64
  • plug Vendorelixir-plug Affected 1.4.0 to before 1.15.4; 1.16.0 to before 1.16.3; 1.17.0 to before 1.17.1; 1.18.0 to before 1.18.2; 1.19.0 to before 1.19.2 Fixed in 1.15.4, 1.16.3, 1.17.1, 1.18.2, 1.19.2 Patch available CNA
  • plug (Hex) Vendor— Affected 1.4.0 to before 1.15.4 Fixed in 1.15.4 Patch available GHSA-468c-vq7p-gh64
  • plug (Hex) Vendor— Affected 1.16.0 to before 1.16.3 Fixed in 1.16.3 Patch available GHSA-468c-vq7p-gh64
  • plug (Hex) Vendor— Affected 1.17.0 to before 1.17.1 Fixed in 1.17.1 Patch available GHSA-468c-vq7p-gh64
  • plug (Hex) Vendor— Affected 1.18.0 to before 1.18.2 Fixed in 1.18.2 Patch available GHSA-468c-vq7p-gh64
  • plug (Hex) Vendor— Affected 1.19.0 to before 1.19.2 Fixed in 1.19.2 Patch available GHSA-468c-vq7p-gh64

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:plug_project:plug:*:*:*:*:*:*:*:*——Plug Project
  • cpe:2.3:a:plug_project:plug:*:*:*:*:*:*:*:* Versions — — ·Plug Project

Remediation

  • Fix · CNA plug (elixir-plug) Fixed in 1.15.4, 1.16.3, 1.17.1, 1.18.2, 1.19.2
  • Fix · GHSA-468c-vq7p-gh64 plug (Hex) Fixed in 1.15.4 Advisory →
  • Fix · GHSA-468c-vq7p-gh64 plug (Hex) Fixed in 1.16.3 Advisory →
  • Fix · GHSA-468c-vq7p-gh64 plug (Hex) Fixed in 1.17.1 Advisory →
  • Fix · GHSA-468c-vq7p-gh64 plug (Hex) Fixed in 1.18.2 Advisory →
  • Fix · GHSA-468c-vq7p-gh64 plug (Hex) Fixed in 1.19.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-8468
  2. 2026-10-03 Alias added: GHSA-468c-vq7p-gh64
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 5

Advisory 2

Other 4

  • TI-2026-39665 Plug: quadratic-time decoding of nested query/body parameters enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-25180 Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy CVSS 4.0HIGH 8.7
  • TI-2026-40967 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) CVSS 4.0MEDIUM 6.9
  • TI-2026-79606 Secret key base leaks into logs via wrong-typed Plug.Crypto arguments CVSS 4.0MEDIUM 5.1
  • TI-2026-40966 Cookie attribute injection in Plug.Conn.Cookies.encode/2 CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences