Vulnerabilities in elixir-plug
6 resultsCVE-2026-56814MEDIUMPlug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)EPSS 1.1%CVE-2026-54892HIGHPlug: quadratic-time decoding of nested query/body parameters enables denial of serviceEPSS 0.9%CVE-2026-8468HIGHUnbounded buffer accumulation in multipart header parsing causes denial of service in plugEPSS 0.6%CVE-2026-32688HIGHAtom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboyEPSS 0.5%CVE-2026-105963MEDIUMSecret key base exposed in stack trace arguments on wrong-typed Plug.Crypto argumentsEPSS 0.5%CVE-2026-56813LOWCookie attribute injection in Plug.Conn.Cookies.encode/2EPSS 0.2%