Inefficient Algorithmic Complexity in Plug Affects Elixir Plug Server

CVE-2026-54892

What is CVE-2026-54892?

A vulnerability in the Plug framework's nested-parameter decoder allows unauthenticated remote attackers to trigger denial of service conditions. When parsing query strings and application/x-www-form-urlencoded request bodies, an attacker can exploit the algorithm's inefficiency by nesting keys deeply, leading to prolonged unresponsiveness of Plug-based servers. With a default body limit of 1,000,000 bytes, an attacker may create requests with excessive nesting levels that consume massive computational resources, ultimately saturating the BEAM scheduler. This vulnerability impacts several Plug versions and does not require knowledge of application routes or prior authentication.

References