High 8.2Published May 14, 2026

CVE-2026-8468Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

Updated under an hour ago (Oct 26, 2026, 1:50 PM ET)

Does this affect you?

It affects elixir-plug plug. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for elixir-plug plug

Exploited in the last 30 days

Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service. This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.

CVSS: 8.2 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: EEF
NVD analysis: Deferred
Record last updated: May 27, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

elixir-plug plug plug_project:plug	from 1.4.0 before 1.15.4; from 1.16.0 before 1.16.3; from 1.17.0 before 1.17.1; from 1.18.0 before 1.18.2; from 1.19.0 before 1.19.2	CNA record

References

References

https://github.com/elixir-plug/plug/security/advisories/GHSA-468c-vq7p-gh64	vendor-advisory, related
https://cna.erlef.org/cves/CVE-2026-8468.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-8468	related
https://cna.erlef.org/cves/CVE-2026-8466.html	related
https://github.com/elixir-plug/plug/commit/2cb7958d33030aa826b0c7404375844d4593d43a	patch
https://github.com/elixir-plug/plug/commit/aa69c5ece99c40ded88b8c6581ecc86664b0b734	patch
https://github.com/elixir-plug/plug/commit/d5dfffe25e975585227b1b85d247b0d14164bc45	patch
https://github.com/elixir-plug/plug/commit/df812a1527bae9e941965e897308a2b8bbf83a94	patch
https://github.com/elixir-plug/plug/commit/33858427c7f2737d560a2e40a0c9a9270d77d1d7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.