Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-407.
Summary
Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many bracketed segments such as a[a][a][a]=1, the decoder walks the brackets and, for each of the N levels, performs a map operation keyed on an ever-growing binary prefix of the key, hashing the full byte range at each step. The total decode cost is therefore quadratic in the number of nesting levels. With the default Plug.Parsers.URLENCODED body limit of 1,000,000 bytes, a single request can carry roughly 333,000 nesting levels and saturate a BEAM scheduler for minutes. A small number of concurrent requests can saturate all schedulers and render a Plug-based server unresponsive. No authentication or knowledge of application routes is required. This vulnerability is associated with program files lib/plug/conn/query.ex and program routines Plug.Conn.Query.decode/4, Plug.Conn.Query.decode_each/2, Plug.Conn.Query.split_keys/6, Plug.Conn.Query.insert_keys/3, and Plug.Conn.Query.finalize_pointer/2. This issue affects plug from 1.15.0 before 1.15.5, 1.16.4, 1.17.2, 1.18.3, and 1.19.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| elixir-plug | plug | 1.15.0 to before 1.15.5; 1.16.0 to before 1.16.4; 1.17.0 to before 1.17.2; 1.18.0 to before 1.18.3; 1.19.0 to before 1.19.3 | 1.15.5, 1.16.4, 1.17.2, 1.18.3, 1.19.3 | Patch available | CNA |
| — | plug (Hex) | 1.15.0 to before 1.15.5 | 1.15.5 | Patch available | GHSA-j43x-5hjq-rgxf |
| — | plug (Hex) | 1.16.0 to before 1.16.4 | 1.16.4 | Patch available | GHSA-j43x-5hjq-rgxf |
| — | plug (Hex) | 1.17.0 to before 1.17.2 | 1.17.2 | Patch available | GHSA-j43x-5hjq-rgxf |
| — | plug (Hex) | 1.18.0 to before 1.18.3 | 1.18.3 | Patch available | GHSA-j43x-5hjq-rgxf |
| — | plug (Hex) | 1.19.0 to before 1.19.3 | 1.19.3 | Patch available | GHSA-j43x-5hjq-rgxf |
- plug Vendorelixir-plug Affected 1.15.0 to before 1.15.5; 1.16.0 to before 1.16.4; 1.17.0 to before 1.17.2; 1.18.0 to before 1.18.3; 1.19.0 to before 1.19.3 Fixed in 1.15.5, 1.16.4, 1.17.2, 1.18.3, 1.19.3 Patch available CNA
- plug (Hex) Vendor— Affected 1.15.0 to before 1.15.5 Fixed in 1.15.5 Patch available GHSA-j43x-5hjq-rgxf
- plug (Hex) Vendor— Affected 1.16.0 to before 1.16.4 Fixed in 1.16.4 Patch available GHSA-j43x-5hjq-rgxf
- plug (Hex) Vendor— Affected 1.17.0 to before 1.17.2 Fixed in 1.17.2 Patch available GHSA-j43x-5hjq-rgxf
- plug (Hex) Vendor— Affected 1.18.0 to before 1.18.3 Fixed in 1.18.3 Patch available GHSA-j43x-5hjq-rgxf
- plug (Hex) Vendor— Affected 1.19.0 to before 1.19.3 Fixed in 1.19.3 Patch available GHSA-j43x-5hjq-rgxf
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:* | — | — | elixir-plug |
- cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:* Versions — — ·elixir-plug
Remediation
- Fix · CNA plug (elixir-plug) Fixed in 1.15.5, 1.16.4, 1.17.2, 1.18.3, 1.19.3
- Fix · GHSA-j43x-5hjq-rgxf plug (Hex) Fixed in 1.15.5 Advisory →
- Fix · GHSA-j43x-5hjq-rgxf plug (Hex) Fixed in 1.16.4 Advisory →
- Fix · GHSA-j43x-5hjq-rgxf plug (Hex) Fixed in 1.17.2 Advisory →
- Fix · GHSA-j43x-5hjq-rgxf plug (Hex) Fixed in 1.18.3 Advisory →
- Fix · GHSA-j43x-5hjq-rgxf plug (Hex) Fixed in 1.19.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54892
- 2026-10-03 Alias added: GHSA-j43x-5hjq-rgxf
References
Patch 5
- https://github.com/elixir-plug/plug/commit/c317d08fdcf96e17931f7419275b2b8c4bf3e951
- https://github.com/elixir-plug/plug/commit/9c5d37c440eaae92869eed7c014c47266744fadb
- https://github.com/elixir-plug/plug/commit/d737eb236f17e31a36290e39f9ef3cd86a1343bd
- https://github.com/elixir-plug/plug/commit/d4e5568392a4b29e545b91e12e87d6098f976145
- https://github.com/elixir-plug/plug/commit/a61124aa625d819a218fb07f90afbac8aa85eb0e
Advisory 2
More elixir-plug vulnerabilities
- TI-2026-25180 Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy CVSS 4.0HIGH 8.7
- TI-2026-40967 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) CVSS 4.0MEDIUM 6.9
- TI-2026-07437 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug CVSS 4.0HIGH 8.2
- TI-2026-79606 Secret key base leaks into logs via wrong-typed Plug.Crypto arguments CVSS 4.0MEDIUM 5.1
- TI-2026-40966 Cookie attribute injection in Plug.Conn.Cookies.encode/2 CVSS 4.0LOW 2.1
Sources
- CVE-2026-54892 · CVE Program
- CVE-2026-54892 · NVD
- FIRST EPSS
- GHSA-j43x-5hjq-rgxf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences