DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54892: CVE-2026-54892: Algorithmic Complexity Denial of Service in Plug Query Decoder

#security #cve #cybersecurity

CVE-2026-54892: Algorithmic Complexity Denial of Service in Plug Query Decoder

Vulnerability ID: CVE-2026-54892
CVSS Score: 8.7
Published: 2026-09-23

An algorithmic complexity vulnerability (CWE-407) in the query decoder of the Elixir Plug library (CVE-2026-54892) allows unauthenticated remote attackers to trigger scheduler starvation and denial of service by transmitting deeply nested brackets in query parameters or URL-encoded post bodies.

TL;DR

Unauthenticated remote attackers can exhaust Erlang VM schedulers and cause a Denial of Service via deeply nested parameter keys in URL-encoded requests.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-407
  • Attack Vector: Network
  • CVSS v4.0 Score: 8.7
  • Affected Component: Plug.Conn.Query.decode/4
  • Exploit Status: poc
  • Remediation Status: Patched

Affected Systems

  • Elixir Web Applications
  • Phoenix Framework Applications using Plug < 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3
  • plug: >= 1.15.0, < 1.15.5 (Fixed in: 1.15.5)
  • plug: >= 1.16.0, < 1.16.4 (Fixed in: 1.16.4)
  • plug: >= 1.17.0, < 1.17.2 (Fixed in: 1.17.2)
  • plug: >= 1.18.0, < 1.18.3 (Fixed in: 1.18.3)
  • plug: >= 1.19.0, < 1.19.3 (Fixed in: 1.19.3)

Code Analysis

Commit: 9c5d37c

Restrict query nesting to 32 keys to prevent quadratic complexity DoS

Mitigation Strategies

  • Upgrade Plug dependency to safe version
  • Limit urlencoded request body size in endpoint config
  • Deploy WAF rule to block highly nested keys

Remediation Steps:

  1. Open mix.exs and locate the :plug dependency declaration.
  2. Update the version constraint to use one of the patched versions: ~> 1.15.5, ~> 1.16.4, ~> 1.17.2, ~> 1.18.3, or ~> 1.19.3.
  3. Run mix deps.get followed by mix deps.compile to fetch and compile the secure version.
  4. Deploy the updated application to production environments.

References

Read the full report for CVE-2026-54892 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)