Braidon Whatley

**Name of the Vulnerable Software and Affected Versions** plug versions 1.15.0 through 1.15.4 plug version 1.16.4 plug version 1.17.2 plug version 1.18.3 plug version 1.19.3 **Description** Inefficient algorithmic complexity in the nested-parameter decoder allows an unauthenticated remote attacker to cause a denial of service. The functions `Plug.Conn.Query.decode/4` and `Plug.Conn.Query.decode each/2` parse query strings and application/x-www-form-urlencoded request bodies. When a key contains numerous bracketed segments, the decoder performs a map operation for each nesting level using an ever-growing binary prefix of the key, resulting in a quadratic decode cost. With a default body limit of 1,000,000 bytes, a single request can contain approximately 333,000 nesting levels, saturating a BEAM scheduler for several minutes. A small number of concurrent requests can saturate all schedulers, rendering the server unresponsive. This issue involves the file lib/plug/conn/query.ex and the routines `Plug.Conn.Query.decode/4`, `Plug.Conn.Query.decode each/2`, `Plug.Conn.Query.split keys/6`, `Plug.Conn.Query.insert keys/3`, and `Plug.Conn.Query.finalize pointer/2`. **Recommendations** Update plug versions 1.15.0 through 1.15.4 to version 1.15.5. Update plug version 1.16.4 to a non-vulnerable version. Update plug version 1.17.2 to a non-vulnerable version. Update plug version 1.18.3 to a non-vulnerable version. Update plug version 1.19.3 to a non-vulnerable version.