AIKIDO-2026-875853
plug is vulnerable to Inefficient Algorithmic Complexity
87
High Risk
This Affects:
plugTL;DR
Affected versions of Plug are vulnerable to a denial-of-service (DoS) issue because the nested parameter decoder processes deeply nested URL-encoded parameters with quadratic time complexity. A remote attacker can send a specially crafted request to consume excessive CPU resources and make a Plug-based application unresponsive without authentication.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
plug is vulnerable to Inefficient Algorithmic Complexity in versions 1.15.0 - 1.15.4, 1.16.0 - 1.16.3, 1.17.0 - 1.17.1, 1.18.0 - 1.18.2 and 1.19.0 - 1.19.2.
How to fix this
Upgrade the plug library to the patch version.
Links
Fix Commits
github.com/elixir-plug/plug/commit/9c5d37c440eaae92869eed7c014c47266744fadbgithub.com/elixir-plug/plug/commit/a61124aa625d819a218fb07f90afbac8aa85eb0egithub.com/elixir-plug/plug/commit/c317d08fdcf96e17931f7419275b2b8c4bf3e951github.com/elixir-plug/plug/commit/d4e5568392a4b29e545b91e12e87d6098f976145github.com/elixir-plug/plug/commit/d737eb236f17e31a36290e39f9ef3cd86a1343bd
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant