PT-2026-57158 · Plug · Plug

Jonatan Männchen + 2 · Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-56814

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions plug versions 1.4.0 through 1.16.5 plug versions 1.17.0 through 1.17.3 plug versions 1.18.0 through 1.18.4 plug versions 1.19.0 through 1.19.4 plug versions 1.20.0 through 1.20.2

Description The Plug.Parsers.MULTIPART request-body parser, used for file uploads and multipart forms, fails to enforce the :length budget across all consumed resources. The parser only counts bytes in the part body, ignoring part header bytes and parts with empty bodies. An unauthenticated remote attacker can exploit this by sending a single request containing numerous empty-body file parts with a non-empty filename in the Content-Disposition. This process triggers the creation of a temporary file via Plug.Upload and retains a Plug.Upload struct for each part, leading to unbounded memory growth and exhaustion of disk space and inodes. The issue is linked to the file lib/plug/parsers/multipart.ex and the functions Plug.Parsers.MULTIPART.parse multipart/2, Plug.Parsers.MULTIPART.parse multipart headers/5, Plug.Parsers.MULTIPART.parse multipart body/4, and Plug.Parsers.MULTIPART.parse multipart file/4.

Recommendations Update plug to version 1.16.6 or later. Update plug to version 1.17.4 or later. Update plug to version 1.18.5 or later. Update plug to version 1.19.5 or later. Update plug to version 1.20.3 or later.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-56814

GHSA-95QV-C9G9-RM63

Affected Products

Plug

References · 11

• https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e · Patch
• https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364 · Patch
• https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63 · Vendor Advisory
• https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6 · Patch
• https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f · Patch
• https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56 · Patch
• https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc · Patch
• https://osv.dev/vulnerability/EEF-CVE-2026-56814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56814 · Security Note
• https://cna.erlef.org/cves/CVE-2026-56814.html · Note
• https://hex.pm/packages/plug · Note