Denial of Service Vulnerability in Plug Project by Elixir

CVE-2026-8468

What is CVE-2026-8468?

The Plug Project for Elixir is vulnerable to a Denial of Service attack due to improper resource allocation in its multipart header parsing. An unauthenticated attacker can exploit the flaw by sending a multipart/form-data request that lacks a complete header section, leading to unchecked memory accumulation as the server processes incoming request bytes. This vulnerability allows the attacker to exhaust server memory by making concurrent uploads, resulting in a complete service outage for users.

References