CVE-2026-54892

Name of the Vulnerable Software and Affected Versions plug versions 1.15.0 through 1.15.4 plug version 1.16.4 plug version 1.17.2 plug version 1.18.3 plug version 1.19.3

Description Inefficient algorithmic complexity in the nested-parameter decoder allows an unauthenticated remote attacker to cause a denial of service. The functions Plug.Conn.Query.decode/4 and Plug.Conn.Query.decode each/2 parse query strings and application/x-www-form-urlencoded request bodies. When a key contains numerous bracketed segments, the decoder performs a map operation for each nesting level using an ever-growing binary prefix of the key, resulting in a quadratic decode cost. With a default body limit of 1,000,000 bytes, a single request can contain approximately 333,000 nesting levels, saturating a BEAM scheduler for several minutes. A small number of concurrent requests can saturate all schedulers, rendering the server unresponsive. This issue involves the file lib/plug/conn/query.ex and the routines Plug.Conn.Query.decode/4, Plug.Conn.Query.decode each/2, Plug.Conn.Query.split keys/6, Plug.Conn.Query.insert keys/3, and Plug.Conn.Query.finalize pointer/2.

Recommendations Update plug versions 1.15.0 through 1.15.4 to version 1.15.5. Update plug version 1.16.4 to a non-vulnerable version. Update plug version 1.17.2 to a non-vulnerable version. Update plug version 1.18.3 to a non-vulnerable version. Update plug version 1.19.3 to a non-vulnerable version.