elixir-plug vulnerabilities

Newest CVEs

• CVE-2026-105963

  Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

  elixir-plug · plug

  Medium5.1
• CVE-2026-56813

  Cookie attribute injection in Plug.Conn.Cookies.encode/2

  elixir-plug · plug

  Low2.1
• CVE-2026-56814

  Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

  elixir-plug · plug

  Medium6.9
• CVE-2026-54892

  Plug: quadratic-time decoding of nested query/body parameters enables denial of service

  elixir-plug · plug

  High8.7
• CVE-2026-8468

  Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

  elixir-plug · plug

  High8.2
• CVE-2026-32688

  Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy

  elixir-plug · plug_cowboy

  High8.7