Priority LOW 24
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs…
Vulnerabilities
6 records
Priority LOW 11
Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.
TI-2026-40967 CVE-2026-56814
Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)
Priority LOW 39
Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker t…
TI-2026-39665 CVE-2026-54892 · GHSA-j43x-5hjq-rgxf
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Priority HIGH 77
Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service.
TI-2026-07437 CVE-2026-8468 · GHSA-468c-vq7p-gh64
Unbounded buffer accumulation in multipart header parsing causes denial of service in plug
Priority LOW 37
Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.
TI-2026-25180 CVE-2026-32688 · GHSA-q8x4-x7mp-5vg2
Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy
Priority MEDIUM 44
Allocation of Resources Without Limits or Throttling vulnerability in elixir-plug plug_cowboy allows unauthenticated remote denial of service via atom table exhaustion.