CVE-2026-56814
Full vulnerability record from the local CVENow database.
Description
Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero. Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP. This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4. This issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.
Severity
MEDIUM
CVSS score
6.9
(v4.0)
Vulnerability status
Deferred
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-07-10 12:17:24.837000
Last modified
2026-10-24 23:10:00.160000
View original CVE JSON
{
"id": "CVE-2026-56814",
"sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"published": "2026-07-10T12:17:24.837",
"lastModified": "2026-10-24T23:10:00.160",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.\n\nBecause every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.\n\nThis vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.\n\nThis issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3."
},
{
"lang": "es",
"value": "Plug.Parsers.MULTIPART, el analizador de cuerpo de solicitud multipart utilizado para manejar cargas de archivos y formularios multipart, no aplica su presupuesto de :length contra todos los recursos consumidos, permitiendo a un atacante remoto no autenticado causar denegación de servicio. El analizador cobra el límite de :length solo por los bytes del cuerpo de la parte; los bytes del encabezado de la parte nunca se cuentan, y una parte con un cuerpo vacío cuesta cero.\n\nDebido a que cada parte cuyo Content-Disposition lleva un nombre de archivo no vacío crea un archivo temporal nuevo (a través de Plug.Upload) y retiene una estructura Plug.Upload durante la duración de la solicitud, un atacante puede enviar una única solicitud compuesta de muchas partes de archivo con cuerpo vacío. Dicha solicitud se mantiene muy por debajo del límite de :length configurado (8,000,000 bytes por defecto) mientras crea un archivo temporal por parte, lo que lleva al agotamiento de inodos y disco y a un crecimiento ilimitado de la memoria. Cualquier aplicación que utilice Plug.Parsers con el analizador :multipart se ve afectada, y no se requiere autenticación, solo la accesibilidad de un punto final multipart a través de HTTP.\n\nEsta vulnerabilidad está asociada con los archivos de programa lib/plug/parsers/multipart.ex y las rutinas de programa Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4 y Plug.Parsers.MULTIPART.parse_multipart_file/4.\n\nEste problema afecta a plug: desde 1.4.0 antes de 1.16.6, desde 1.17.0 antes de 1.17.4, desde 1.18.0 antes de 1.18.5, desde 1.19.0 antes de 1.19.5 y desde 1.20.0 antes de 1.20.3."
}
],
"affected": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"affectedData": [
{
"vendor": "elixir-plug",
"product": "plug",
"defaultStatus": "unaffected",
"collectionURL": "https://repo.hex.pm",
"packageName": "plug",
"cpes": [
"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.Plug.Parsers.MULTIPART'"
],
"programFiles": [
"lib/plug/parsers/multipart.ex"
],
"programRoutines": [
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"
}
],
"repo": "https://github.com/elixir-plug/plug",
"packageURL": "pkg:hex/plug",
"versions": [
{
"version": "1.4.0-rc.0",
"lessThan": "1.16.6",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.17.0",
"lessThan": "1.17.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.18.0",
"lessThan": "1.18.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.19.1",
"lessThan": "1.19.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.20.0",
"lessThan": "1.20.3",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "elixir-plug",
"product": "plug",
"defaultStatus": "unaffected",
"collectionURL": "https://github.com",
"packageName": "elixir-plug/plug",
"cpes": [
"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
],
"modules": [
"'Elixir.Plug.Parsers.MULTIPART'"
],
"programFiles": [
"lib/plug/parsers/multipart.ex"
],
"programRoutines": [
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"
}
],
"repo": "https://github.com/elixir-plug/plug",
"packageURL": "pkg:github/elixir-plug/plug",
"versions": [
{
"version": "c52b2f32c90bccd718202bafccb5f95594e30183",
"lessThan": "*",
"versionType": "git",
"status": "affected",
"changes": [
{
"at": "981597d3a4271ede64373c7a731702a42c500dd6",
"status": "unaffected"
},
{
"at": "56edca2ce35fe5589cd581644d8a4493fa5f484e",
"status": "unaffected"
},
{
"at": "0ee8afcc61466dc5f7a8f048d0632c899165b81f",
"status": "unaffected"
},
{
"at": "cae36053350e5215a4e0ca33cd130af9c5fc6364",
"status": "unaffected"
},
{
"at": "f7effaed811c00b5f5bf817936bfd9c5df27b7dc",
"status": "unaffected"
},
{
"at": "df97d3f17f808a9916a7700a701fb85314559d56",
"status": "unaffected"
}
]
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-10T14:03:11.744626Z",
"id": "CVE-2026-56814",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"references": [
{
"url": "https://cna.erlef.org/cves/CVE-2026-56814.html",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/elixir-plug/plug/commit/c52b2f32c90bccd718202bafccb5f95594e30183",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
},
{
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-56814",
"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
}
]
}