CVE-2026-8468: Unbounded buffer accumulation in multipart header parsing causes denial of service in plug
Summary
An Allocation of Resources Without Limits or Throttling vulnerability in Plug.Conn.readpartheaders/2 allows an unauthenticated attacker to exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.
Details
Plug.Conn.readpartheaders/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function readpartbody has an explicit bytesize(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in readpartheaders.
Impact
This is a denial-of-service vulnerability. Any application using Plug.Parsers with the :multipart parser, or calling Plug.Conn.readpartheaders/2 directly, is affected. An unauthenticated remote attacker can trigger the issue by sending crafted HTTP requests with no special privileges.
References
Intro Commit: https://github.com/elixir-plug/plug/commit/c52b2f32c90bccd718202bafccb5f95594e30183 Patch Commit: https://github.com/elixir-plug/plug/commit/d878b42efea9f12b243dc3e362a2ed048a798203
Other sources
Allocation of Resources Without Limits or Throttling vulnerability in plugproject plug allows denial of service via unbounded buffer accumulation in multipart header parsing.
'Elixir.Plug.Conn':readpartheaders/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function readpartbody has an explicit bytesize(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in readpartheaders. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.
This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erlang/plugto a version that resolves this vulnerability.Fixed in 1.19.2 - Upgrade
Upgrade
erlang/plugto a version that resolves this vulnerability.Fixed in 1.18.2 - Upgrade
Upgrade
erlang/plugto a version that resolves this vulnerability.Fixed in 1.17.1 - Upgrade
Upgrade
erlang/plugto a version that resolves this vulnerability.Fixed in 1.16.3 - Upgrade
Upgrade
erlang/plugto a version that resolves this vulnerability.Fixed in 1.15.4 - Upgrade
Upgrade
plugto a version that resolves this vulnerability.Fixed in 1.15.4 - Upgrade
Upgrade
plugto a version that resolves this vulnerability.Fixed in 1.16.3 - Upgrade
Upgrade
plugto a version that resolves this vulnerability.Fixed in 1.17.1 - Upgrade
Upgrade
plugto a version that resolves this vulnerability.Fixed in 1.18.2 - Upgrade
Upgrade
plugto a version that resolves this vulnerability.Fixed in 1.19.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8468?
CVE-2026-8468 is classified as a denial of service vulnerability due to unbounded buffer accumulation.
How do I fix CVE-2026-8468?
To mitigate CVE-2026-8468, ensure you update to a version of the plug that is not affected, specifically versions outside the specified vulnerable ranges.
Which versions of plug are affected by CVE-2026-8468?
CVE-2026-8468 affects plug versions between 1.4.0 and 1.15.4, 1.16.0 and 1.16.3, 1.17.0 and 1.17.1, 1.18.0 and 1.18.2, and 1.19.0 and 1.19.2.
What causes CVE-2026-8468?
CVE-2026-8468 is caused by unbounded buffer accumulation during multipart header parsing in the plug software.
What is the impact of CVE-2026-8468?
The impact of CVE-2026-8468 is a denial of service, potentially making the affected application unresponsive.