Skip to content
Fencer Vulns
high 8.2

CVE-2026-8468 json

Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

published 2026-05-14 5 mo ago modified 2026-10-26 13 d ago also EEF-CVE-2026-8468 , GHSA-468c-vq7p-gh64 , EUVD-2026-30266

cvss
8.2
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.

'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.

This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.

Patch / fix

  • hex plug 1.15.4, 1.16.3, 1.17.1, 1.18.2, 1.19.2
  • elixir-plug plug 1.15.4, 1.16.3, 1.17.1, 1.18.2, 1.19.2

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
hex plug
>=1.4.0, <1.15.4
>=1.16.0, <1.16.3
>=1.17.0, <1.17.1
>=1.18.0, <1.18.2
>=1.19.0, <1.19.2
1.15.4
1.16.3
1.17.1
1.18.2
1.19.2

Affected products

  • elixir-plug plug

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.