PT-2026-40905 · Plug · Plug

Jonatan Männchen + 1 · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-8468

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions plug versions 1.4.0 through 1.15.3 plug version 1.16.3 plug version 1.17.1 plug version 1.18.2 plug version 1.19.2

Description An unbounded buffer accumulation issue exists during multipart header parsing. The function read part headers/2 in lib/plug/conn.ex fails to obey its :length parameter and lacks an upper bound on the size of the accumulated buffer. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request where the body never yields a complete header section, such as by omitting the boundary delimiter or the r r sequence. This causes the server process to accumulate memory linearly, potentially leading to a denial of service by exhausting BEAM memory.

Recommendations Update plug to version 1.15.4 or newer. Update plug to a version later than 1.16.3. Update plug to a version later than 1.17.1. Update plug to a version later than 1.18.2. Update plug to a version later than 1.19.2.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-8468

GHSA-468C-VQ7P-GH64

Affected Products

Plug

References · 11

• https://github.com/elixir-plug/plug/commit/d5dfffe25e975585227b1b85d247b0d14164bc45 · Patch
• https://github.com/elixir-plug/plug/commit/33858427c7f2737d560a2e40a0c9a9270d77d1d7 · Patch
• https://github.com/elixir-plug/plug/commit/df812a1527bae9e941965e897308a2b8bbf83a94 · Patch
• https://github.com/elixir-plug/plug/commit/2cb7958d33030aa826b0c7404375844d4593d43a · Patch
• https://github.com/elixir-plug/plug/commit/aa69c5ece99c40ded88b8c6581ecc86664b0b734 · Patch
• https://github.com/elixir-plug/plug/security/advisories/GHSA-468c-vq7p-gh64 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8468 · Security Note
• https://osv.dev/vulnerability/EEF-CVE-2026-8468 · Vendor Advisory
• https://cna.erlef.org/cves/CVE-2026-8468.html · Note
• https://hex.pm/packages/plug · Note
• https://cna.erlef.org/cves/CVE-2026-8466.html · Note