{"id":"CVE-2026-8468","aliases":["EEF-CVE-2026-8468","EUVD-2026-30266","GHSA-468c-vq7p-gh64"],"status":"published","title":"Unbounded buffer accumulation in multipart header parsing causes denial of service in plug","description":"Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\n'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) \u003e length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.\n\nThis issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0062,"percentile":0.50018,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-05-14T10:29:51Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Hex","package":"plug","fixed_in":["1.15.4","1.16.3","1.17.1","1.18.2","1.19.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.15.4"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.16.0"},{"fixed":"1.16.3"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.0"},{"fixed":"1.17.1"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.0"},{"fixed":"1.18.2"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"plug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0"},{"fixed":"1.19.2"}]}]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.15.4"}]},{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.16.3"}]},{"type":"SEMVER","events":[{"introduced":"1.17.0"},{"fixed":"1.17.1"}]},{"type":"SEMVER","events":[{"introduced":"1.18.0"},{"fixed":"1.18.2"}]},{"type":"SEMVER","events":[{"introduced":"1.19.0"},{"fixed":"1.19.2"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.12.0","1.12.1","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.14.0","1.14.1","1.14.2","1.15.0","1.15.1","1.15.2","1.15.3","1.16.0","1.16.1","1.16.2","1.17.0","1.18.0","1.18.1","1.19.0","1.19.1","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.0-rc.0","1.5.0-rc.1","1.5.0-rc.2","1.5.1","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.7.0","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.9.0"]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.4.0"},{"fixed":"1.15.4"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.12.0","1.12.1","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.14.0","1.14.1","1.14.2","1.15.0","1.15.1","1.15.2","1.15.3","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.0-rc.0","1.5.0-rc.1","1.5.0-rc.2","1.5.1","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.7.0","1.7.1","1.7.2","1.8.0","1.8.1","1.8.2","1.8.3","1.9.0"]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.16.0"},{"fixed":"1.16.3"}]}],"versions":["1.16.0","1.16.1","1.16.2"]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.17.0"},{"fixed":"1.17.1"}]}],"versions":["1.17.0"]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.18.0"},{"fixed":"1.18.2"}]}],"versions":["1.18.0","1.18.1"]},{"source":"osv","ecosystem":"Hex","package":"plug","ranges":[{"type":"SEMVER","events":[{"introduced":"1.19.0"},{"fixed":"1.19.2"}]}],"versions":["1.19.0","1.19.1"]}],"products":[{"vendor":"elixir-plug","product":"plug"}],"references":[{"url":"https://github.com/elixir-plug/plug/security/advisories/GHSA-468c-vq7p-gh64","tags":["vendor-advisory","related","advisory","web"]},{"url":"https://cna.erlef.org/cves/CVE-2026-8468.html","tags":["related","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-8468","tags":["related","web"]},{"url":"https://cna.erlef.org/cves/CVE-2026-8466.html","tags":["related","web"]},{"url":"https://github.com/elixir-plug/plug/commit/2cb7958d33030aa826b0c7404375844d4593d43a","tags":["patch","fix","web"]},{"url":"https://github.com/elixir-plug/plug/commit/aa69c5ece99c40ded88b8c6581ecc86664b0b734","tags":["patch","fix","web"]},{"url":"https://github.com/elixir-plug/plug/commit/d5dfffe25e975585227b1b85d247b0d14164bc45","tags":["patch","fix","web"]},{"url":"https://github.com/elixir-plug/plug/commit/df812a1527bae9e941965e897308a2b8bbf83a94","tags":["patch","fix","web"]},{"url":"https://github.com/elixir-plug/plug/commit/33858427c7f2737d560a2e40a0c9a9270d77d1d7","tags":["patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8468","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-468c-vq7p-gh64"},{"url":"https://github.com","tags":["web"]},{"url":"https://repo.hex.pm","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8468.json","tags":["advisory"]},{"url":"https://github.com/elixir-plug/plug","tags":["package"]},{"url":"https://hex.pm/packages/plug","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-8468","title":"Unbounded buffer accumulation in multipart header parsing causes denial of service in plug","description":"Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\n'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) \u003e length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.\n\nThis issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.","status":"published","published":"2026-05-14T10:29:51.062Z","modified":"2026-05-27T15:41:29.241Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-30266","description":"Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\n'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) \u003e length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.\n\nThis issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.","status":"published","published":"2026-05-14T10:29:51Z","modified":"2026-05-27T15:41:29Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:21:03.926243Z"}],"ghsa":[{"id":"GHSA-468c-vq7p-gh64","title":"Plug: Unbounded buffer accumulation in multipart header parsing causes denial of service","description":"### Summary\n\nAn Allocation of Resources Without Limits or Throttling vulnerability in `Plug.Conn.read_part_headers/2` allows an unauthenticated attacker to exhaust server memory by sending a crafted `multipart/form-data` request, causing a denial of service.\n\n### Details\n\n`Plug.Conn.read_part_headers/2` in `lib/plug/conn.ex` does not obey its `:length` parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function `read_part_body` has an explicit `byte_size(acc) \u003e length` guard that stops accumulation once a limit is reached. No such guard exists in `read_part_headers`.\n\n### Impact\n\nThis is a denial-of-service vulnerability. Any application using `Plug.Parsers` with the `:multipart` parser, or calling `Plug.Conn.read_part_headers/2` directly, is affected. An unauthenticated remote attacker can trigger the issue by sending crafted HTTP requests with no special privileges.\n\n### References\n\n* Intro Commit: https://github.com/elixir-plug/plug/commit/c52b2f32c90bccd718202bafccb5f95594e30183\n* Patch Commit: https://github.com/elixir-plug/plug/commit/d878b42efea9f12b243dc3e362a2ed048a798203","status":"published","published":"2026-05-20T15:35:13Z","modified":"2026-05-20T15:35:14Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:40:13.628377Z"}],"nvd":[{"id":"CVE-2026-8468","description":"Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\n'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) \u003e length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.\n\nThis issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.","status":"published","published":"2026-05-14T11:16:18.9Z","modified":"2026-10-26T14:10:00.13Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-8468","title":"Unbounded buffer accumulation in multipart header parsing causes denial of service in plug","description":"Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\n'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) \u003e length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.\n\nThis issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.","status":"published","published":"2026-05-14T10:29:51.062Z","modified":"2026-10-28T02:30:39.824240902Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"EEF-CVE-2026-8468","title":"Unbounded buffer accumulation in multipart header parsing causes denial of service in plug","description":"## Summary\n\nAllocation of Resources Without Limits or Throttling vulnerability in plug\\_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.\n\n'Elixir.Plug.Conn':read\\_part\\_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read\\_part\\_body has an explicit byte\\_size(acc) \u003e length guard that stops accumulation once a limit is reached. No such guard exists in read\\_part\\_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.\n\nThis issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.\n\n## Configurations\n\nThe application must use Plug.Parsers with the :multipart parser, or otherwise call Plug.Conn.read\\_part\\_headers/2 to process multipart/form-data request bodies. Deployments that do not handle multipart uploads are not affected.","status":"published","published":"2026-05-14T10:29:51.062Z","modified":"2026-09-08T03:30:12.589472756Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:33.520522Z"},{"id":"GHSA-468c-vq7p-gh64","title":"Plug: Unbounded buffer accumulation in multipart header parsing causes denial of service","description":"### Summary\n\nAn Allocation of Resources Without Limits or Throttling vulnerability in `Plug.Conn.read_part_headers/2` allows an unauthenticated attacker to exhaust server memory by sending a crafted `multipart/form-data` request, causing a denial of service.\n\n### Details\n\n`Plug.Conn.read_part_headers/2` in `lib/plug/conn.ex` does not obey its `:length` parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function `read_part_body` has an explicit `byte_size(acc) \u003e length` guard that stops accumulation once a limit is reached. No such guard exists in `read_part_headers`.\n\n### Impact\n\nThis is a denial-of-service vulnerability. Any application using `Plug.Parsers` with the `:multipart` parser, or calling `Plug.Conn.read_part_headers/2` directly, is affected. An unauthenticated remote attacker can trigger the issue by sending crafted HTTP requests with no special privileges.\n\n### References\n\n* Intro Commit: https://github.com/elixir-plug/plug/commit/c52b2f32c90bccd718202bafccb5f95594e30183\n* Patch Commit: https://github.com/elixir-plug/plug/commit/d878b42efea9f12b243dc3e362a2ed048a798203","status":"published","published":"2026-05-20T15:35:13Z","modified":"2026-05-20T15:48:07.798538088Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:36.434231Z"}]}}