CVE-2026-56814
MediumCVSS 6.9Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
The multipart parser in Plug.Parsers.MULTIPART does not enforce its :length budget against all consumed resources, allowing an unauthenticated attacker to cause denial of service. Part headers are not counted, and empty parts create temporary files, leading to inode, disk, and memory exhaustion. Affected versions: plug from 1.4.0-rc.0 before 1.16.6, 1.17.0 before 1.17.4, 1.18.0 before 1.18.5, 1.19.1 before 1.19.5, and 1.20.0 before 1.20.3.
Risk Assessment
The organization is at risk of DoS attacks that could lead to application unavailability. Exhaustion of system resources may also affect other services.
Recommendation
Upgrade plug to version 1.16.6, 1.17.4, 1.18.5, 1.19.5, or 1.20.3 depending on the line in use. Additionally, consider limiting request size and number of parts at the server level.
Other vulnerabilities in Plug
See all- CVE-2026-54892High
Plug has an efficiency issue in the nested-parameter decoder that allows an unauthenticated remote attacker to cause denial of service. The decoding algorithm's complexity is quadratic in relation to the number of nesting levels, which can lead to server unresponsiveness.
- CVE-2026-56813Low
In the elixir-plug plug library, Plug.Conn.Cookies.encode/2 builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes without neutralizing the ; delimiter. An application that places attacker-controlled data into a cookie value or attribute lets an attacker inject a ; to append or override cookie attributes.
Original NVD description (English source)
Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero. Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP. This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4. This issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS