AIKIDO-2026-979167

TL;DR

Plug.Parsers.MULTIPART, the multipart request-body parser in the plug Elixir library that handles file uploads and multipart forms, does not charge its :length budget against file uploads. An unauthenticated remote attacker who can reach any multipart endpoint can send a single request composed of many empty-body file parts that stays well under the configured :length limit (8 MB by default), exhausting inodes and disk and growing memory (denial of service).