AIKIDO-2026-979167
plug is vulnerable to Denial of Service (DoS)
69
Medium Risk
This Affects:
plugTL;DR
Plug.Parsers.MULTIPART, the multipart request-body parser in the plug Elixir library that handles file uploads and multipart forms, does not charge its :length budget against file uploads. An unauthenticated remote attacker who can reach any multipart endpoint can send a single request composed of many empty-body file parts that stays well under the configured :length limit (8 MB by default), exhausting inodes and disk and growing memory (denial of service).
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
plug is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 1.16.5, 1.17.0 - 1.17.3, 1.18.0 - 1.18.4, 1.19.0 - 1.19.4 and 1.20.0 - 1.20.2.
How to fix this
Upgrade the plug library to the patch version.
Links
Fix Commits
github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81fgithub.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484egithub.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant