← Back to CVE Explorer

CVE-2026-54892

Full vulnerability record from the local CVENow database.

Description

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many bracketed segments such as a[a][a][a]=1, the decoder walks the brackets and, for each of the N levels, performs a map operation keyed on an ever-growing binary prefix of the key, hashing the full byte range at each step. The total decode cost is therefore quadratic in the number of nesting levels. With the default Plug.Parsers.URLENCODED body limit of 1,000,000 bytes, a single request can carry roughly 333,000 nesting levels and saturate a BEAM scheduler for minutes. A small number of concurrent requests can saturate all schedulers and render a Plug-based server unresponsive. No authentication or knowledge of application routes is required. This vulnerability is associated with program files lib/plug/conn/query.ex and program routines Plug.Conn.Query.decode/4, Plug.Conn.Query.decode_each/2, Plug.Conn.Query.split_keys/6, Plug.Conn.Query.insert_keys/3, and Plug.Conn.Query.finalize_pointer/2. This issue affects plug from 1.15.0 before 1.15.5, 1.16.4, 1.17.2, 1.18.3, and 1.19.3.

Severity
HIGH
CVSS score
8.7 (v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-06-23 13:16:43.167000
Last modified
2026-10-25 23:10:00.167000
View original CVE JSON 
{
  "id": "CVE-2026-54892",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-06-23T13:16:43.167",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 (and Plug.Conn.Query.decode_each/2) parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many bracketed segments such as a[a][a][a]=1, the decoder walks the brackets and, for each of the N levels, performs a map operation keyed on an ever-growing binary prefix of the key, hashing the full byte range at each step. The total decode cost is therefore quadratic in the number of nesting levels.\n\nWith the default Plug.Parsers.URLENCODED body limit of 1,000,000 bytes, a single request can carry roughly 333,000 nesting levels and saturate a BEAM scheduler for minutes. A small number of concurrent requests can saturate all schedulers and render a Plug-based server unresponsive. No authentication or knowledge of application routes is required.\n\nThis vulnerability is associated with program files lib/plug/conn/query.ex and program routines Plug.Conn.Query.decode/4, Plug.Conn.Query.decode_each/2, Plug.Conn.Query.split_keys/6, Plug.Conn.Query.insert_keys/3, and Plug.Conn.Query.finalize_pointer/2.\n\nThis issue affects plug from 1.15.0 before 1.15.5, 1.16.4, 1.17.2, 1.18.3, and 1.19.3."
    },
    {
      "lang": "es",
      "value": "La complejidad algorítmica ineficiente en el decodificador de parámetros anidados de Plug permite a un atacante remoto no autenticado causar denegación de servicio. Plug.Conn.Query.decode/4 (y Plug.Conn.Query.decode_each/2) analizan cadenas de consulta y cuerpos de solicitud application/x-www-form-urlencoded. Cuando una clave contiene muchos segmentos entre corchetes como a[a][a][a]=1, el decodificador recorre los corchetes y, para cada uno de los N niveles, realiza una operación de mapeo indexada en un prefijo binario de la clave en constante crecimiento, aplicando hash a todo el rango de bytes en cada paso. El costo total de decodificación es, por lo tanto, cuadrático en el número de niveles de anidamiento.\n\nCon el límite de cuerpo predeterminado de Plug.Parsers.URLENCODED de 1.000.000 de bytes, una sola solicitud puede transportar aproximadamente 333.000 niveles de anidamiento y saturar un planificador BEAM durante minutos. Un pequeño número de solicitudes concurrentes puede saturar todos los planificadores y dejar un servidor basado en Plug sin respuesta. No se requiere autenticación ni conocimiento de las rutas de la aplicación.\n\nEsta vulnerabilidad está asociada con los archivos de programa lib/plug/conn/query.ex y las rutinas de programa Plug.Conn.Query.decode/4, Plug.Conn.Query.decode_each/2, Plug.Conn.Query.split_keys/6, Plug.Conn.Query.insert_keys/3 y Plug.Conn.Query.finalize_pointer/2.\n\nEste problema afecta a plug desde la versión 1.15.0 anterior a 1.15.5, 1.16.4, 1.17.2, 1.18.3 y 1.19.3."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "elixir-plug",
          "product": "plug",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "plug",
          "cpes": [
            "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Plug.Conn.Query'"
          ],
          "programFiles": [
            "lib/plug/conn/query.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Plug.Conn.Query':decode/4"
            },
            {
              "name": "'Elixir.Plug.Conn.Query':decode_each/2"
            },
            {
              "name": "'Elixir.Plug.Conn.Query':split_keys/6"
            },
            {
              "name": "'Elixir.Plug.Conn.Query':insert_keys/3"
            },
            {
              "name": "'Elixir.Plug.Conn.Query':finalize_pointer/2"
            }
          ],
          "repo": "https://github.com/elixir-plug/plug",
          "packageURL": "pkg:hex/plug",
          "versions": [
            {
              "version": "1.15.0",
              "lessThan": "1.15.5",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.16.0",
              "lessThan": "1.16.4",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.17.0",
              "lessThan": "1.17.2",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.18.0",
              "lessThan": "1.18.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "1.19.0",
              "lessThan": "1.19.3",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "elixir-plug",
          "product": "plug",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "elixir-plug/plug",
          "cpes": [
            "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Plug.Conn.Query'"
          ],
          "programFiles": [
            "lib/plug/conn/query.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Plug.Conn.Query':decode/4"
            },
            {
              "name": "'Elixir.Plug.Conn.Query':decode_each/2"
            },
            {
              "name": "'Elixir.Plug.Conn.Query':split_keys/6"
            },
            {
              "name": "'Elixir.Plug.Conn.Query':insert_keys/3"
            },
            {
              "name": "'Elixir.Plug.Conn.Query':finalize_pointer/2"
            }
          ],
          "repo": "https://github.com/elixir-plug/plug",
          "packageURL": "pkg:github/elixir-plug/plug",
          "versions": [
            {
              "version": "712b875d3442c765d8d37e546ffd5ad9f8afcc55",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected",
              "changes": [
                {
                  "at": "c317d08fdcf96e17931f7419275b2b8c4bf3e951",
                  "status": "unaffected"
                },
                {
                  "at": "9c5d37c440eaae92869eed7c014c47266744fadb",
                  "status": "unaffected"
                },
                {
                  "at": "d737eb236f17e31a36290e39f9ef3cd86a1343bd",
                  "status": "unaffected"
                },
                {
                  "at": "d4e5568392a4b29e545b91e12e87d6098f976145",
                  "status": "unaffected"
                },
                {
                  "at": "a61124aa625d819a218fb07f90afbac8aa85eb0e",
                  "status": "unaffected"
                }
              ]
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T13:03:58.893269Z",
          "id": "CVE-2026-54892",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-54892.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-plug/plug/commit/9c5d37c440eaae92869eed7c014c47266744fadb",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-plug/plug/commit/a61124aa625d819a218fb07f90afbac8aa85eb0e",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-plug/plug/commit/c317d08fdcf96e17931f7419275b2b8c4bf3e951",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-plug/plug/commit/d4e5568392a4b29e545b91e12e87d6098f976145",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-plug/plug/commit/d737eb236f17e31a36290e39f9ef3cd86a1343bd",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-54892",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}