CVE-2026-54892
2 advisories.
Hex/plug CVE-2026-54892: high 8.7, EPSS 0.89%
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Action: Upgrade plug to 1.15.5 (1.15.x), 1.16.4 (1.16.x), 1.17.2 (1.17.x), 1.18.3 (1.18.x) or 1.19.3 (1.19.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.15.0 | 1.15.5 | - |
| 1.16.0 | 1.16.4 | - |
| 1.17.0 | 1.17.2 | - |
| 1.18.0 | 1.18.3 | - |
| 1.19.0 | 1.19.3 | - |
Fixed versions
| 1.15.5 | 1.16.4 | 1.17.2 | 1.18.3 | 1.19.3 |
Sources
- osv: EEF-CVE-2026-54892
- nvd: CVE-2026-54892
- https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf
- https://cna.erlef.org/cves/CVE-2026-54892.html
- https://github.com/elixir-plug/plug/commit/c317d08fdcf96e17931f7419275b2b8c4bf3e951
- https://github.com/elixir-plug/plug/commit/9c5d37c440eaae92869eed7c014c47266744fadb
- https://github.com/elixir-plug/plug/commit/d737eb236f17e31a36290e39f9ef3cd86a1343bd
- https://github.com/elixir-plug/plug/commit/d4e5568392a4b29e545b91e12e87d6098f976145
- https://github.com/elixir-plug/plug/commit/a61124aa625d819a218fb07f90afbac8aa85eb0e
- https://hex.pm/packages/plug
CVE-2026-54892 · published · modified · JSON
Hex/plug CVE-2026-54892: high 8.7, EPSS 0.89%
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Action: Upgrade plug to 1.15.5 (1.15.x), 1.16.4 (1.16.x), 1.17.2 (1.17.x), 1.18.3 (1.18.x) or 1.19.3 (1.19.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.15.0 | 1.15.5 | - |
| 1.16.0 | 1.16.4 | - |
| 1.17.0 | 1.17.2 | - |
| 1.18.0 | 1.18.3 | - |
| 1.19.0 | 1.19.3 | - |
Fixed versions
| 1.15.5 | 1.16.4 | 1.17.2 | 1.18.3 | 1.19.3 |
Sources
- osv: GHSA-j43x-5hjq-rgxf
- nvd: CVE-2026-54892
- https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf
- https://github.com/elixir-plug/plug/commit/9c5d37c440eaae92869eed7c014c47266744fadb
- https://github.com/elixir-plug/plug/commit/a61124aa625d819a218fb07f90afbac8aa85eb0e
- https://github.com/elixir-plug/plug/commit/c317d08fdcf96e17931f7419275b2b8c4bf3e951
- https://github.com/elixir-plug/plug/commit/d4e5568392a4b29e545b91e12e87d6098f976145
- https://github.com/elixir-plug/plug/commit/d737eb236f17e31a36290e39f9ef3cd86a1343bd
- https://cna.erlef.org/cves/CVE-2026-54892.html
- https://github.com/elixir-plug/plug
- https://github.com/elixir-plug/plug/blob/v1.19.3/CHANGELOG.md#v1193-2026-06-23
- https://osv.dev/vulnerability/EEF-CVE-2026-54892
CVE-2026-54892 · published · modified · JSON