CVE-2026-56814

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-56814", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-06-23T12:29:02.507Z", "datePublished": "2026-07-10T11:14:35.574Z", "dateUpdated": "2026-09-24T21:31:15.419Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Plug.Parsers.MULTIPART'"], "packageName": "plug", "packageURL": "pkg:hex/plug", "product": "plug", "programFiles": ["lib/plug/parsers/multipart.ex"], "programRoutines": [{"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"}], "repo": "https://github.com/elixir-plug/plug", "vendor": "elixir-plug", "versions": [{"lessThan": "1.16.6", "status": "affected", "version": "1.4.0-rc.0", "versionType": "semver"}, {"lessThan": "1.17.4", "status": "affected", "version": "1.17.0", "versionType": "semver"}, {"lessThan": "1.18.5", "status": "affected", "version": "1.18.0", "versionType": "semver"}, {"lessThan": "1.19.5", "status": "affected", "version": "1.19.1", "versionType": "semver"}, {"lessThan": "1.20.3", "status": "affected", "version": "1.20.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Plug.Parsers.MULTIPART'"], "packageName": "elixir-plug/plug", "packageURL": "pkg:github/elixir-plug/plug", "product": "plug", "programFiles": ["lib/plug/parsers/multipart.ex"], "programRoutines": [{"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"}], "repo": "https://github.com/elixir-plug/plug", "vendor": "elixir-plug", "versions": [{"changes": [{"at": "981597d3a4271ede64373c7a731702a42c500dd6", "status": "unaffected"}, {"at": "56edca2ce35fe5589cd581644d8a4493fa5f484e", "status": "unaffected"}, {"at": "0ee8afcc61466dc5f7a8f048d0632c899165b81f", "status": "unaffected"}, {"at": "cae36053350e5215a4e0ca33cd130af9c5fc6364", "status": "unaffected"}, {"at": "f7effaed811c00b5f5bf817936bfd9c5df27b7dc", "status": "unaffected"}, {"at": "df97d3f17f808a9916a7700a701fb85314559d56", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "c52b2f32c90bccd718202bafccb5f95594e30183", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.16.6", "versionStartIncluding": "1.4.0-rc.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.17.4", "versionStartIncluding": "1.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.18.5", "versionStartIncluding": "1.18.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.19.5", "versionStartIncluding": "1.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.20.3", "versionStartIncluding": "1.20.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen / EEF"}, {"lang": "en", "type": "remediation developer", "value": "Jos\u00e9 Valim"}], "datePublic": "2026-07-10T11:14:35.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p><code>Plug.Parsers.MULTIPART</code>, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its <code>:length</code> budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the <code>:length</code> limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.</p>\n<p>Because every part whose <code>Content-Disposition</code> carries a non-empty <code>filename</code> creates a fresh temporary file (via <code>Plug.Upload</code>) and retains a <code>Plug.Upload</code> struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured <code>:length</code> limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using <code>Plug.Parsers</code> with the <code>:multipart</code> parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.</p>\n<p>This vulnerability is associated with program files <code>lib/plug/parsers/multipart.ex</code> and program routines <code>Plug.Parsers.MULTIPART.parse_multipart/2</code>, <code>Plug.Parsers.MULTIPART.parse_multipart_headers/5</code>, <code>Plug.Parsers.MULTIPART.parse_multipart_body/4</code>, and <code>Plug.Parsers.MULTIPART.parse_multipart_file/4</code>.</p>\n<p>This issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.</p>"}, {"base64": false, "type": "text/markdown", "value": "`Plug.Parsers.MULTIPART`, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its `:length` budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the `:length` limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.\n\nBecause every part whose `Content-Disposition` carries a non-empty `filename` creates a fresh temporary file (via `Plug.Upload`) and retains a `Plug.Upload` struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured `:length` limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using `Plug.Parsers` with the `:multipart` parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.\n\nThis vulnerability is associated with program files `lib/plug/parsers/multipart.ex` and program routines `Plug.Parsers.MULTIPART.parse_multipart/2`, `Plug.Parsers.MULTIPART.parse_multipart_headers/5`, `Plug.Parsers.MULTIPART.parse_multipart_body/4`, and `Plug.Parsers.MULTIPART.parse_multipart_file/4`.\n\nThis issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3."}], "value": "Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.\n\nBecause every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.\n\nThis vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.\n\nThis issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3."}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T21:31:15.419Z"}, "references": [{"tags": ["vendor-advisory", "related"], "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63"}, {"name": "EEF CNA record for CVE-2026-56814", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-56814.html"}, {"name": "OSV record EEF-CVE-2026-56814", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-56814"}, {"name": "Introducing commit c52b2f3 in elixir-plug/plug", "tags": ["related"], "url": "https://github.com/elixir-plug/plug/commit/c52b2f32c90bccd718202bafccb5f95594e30183"}, {"name": "Fix commit 981597d in elixir-plug/plug", "tags": ["patch"], "url": "https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6"}, {"name": "Fix commit 56edca2 in elixir-plug/plug", "tags": ["patch"], "url": "https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e"}, {"name": "Fix commit 0ee8afc in elixir-plug/plug", "tags": ["patch"], "url": "https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f"}, {"name": "Fix commit cae3605 in elixir-plug/plug", "tags": ["patch"], "url": "https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364"}, {"name": "Fix commit f7effae in elixir-plug/plug", "tags": ["patch"], "url": "https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc"}, {"name": "Fix commit df97d3f in elixir-plug/plug", "tags": ["patch"], "url": "https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56"}], "source": {"discovery": "EXTERNAL"}, "title": "Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-10T14:03:11.744626Z", "id": "CVE-2026-56814", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T14:03:28.156Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-56814", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T14:03:11.744626Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T14:03:24.796Z"}}], "cna": {"title": "Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Peter Ullrich"}, {"lang": "en", "type": "analyst", "value": "Jonatan M\u00e4nnchen"}, {"lang": "en", "type": "remediation developer", "value": "Jos\u00e9 Valim"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-plug/plug", "vendor": "elixir-plug", "modules": ["'Elixir.Plug.Parsers.MULTIPART'"], "product": "plug", "versions": [{"status": "affected", "version": "1.4.0", "lessThan": "1.16.6", "versionType": "semver"}, {"status": "affected", "version": "1.17.0", "lessThan": "1.17.4", "versionType": "semver"}, {"status": "affected", "version": "1.18.0", "lessThan": "1.18.5", "versionType": "semver"}, {"status": "affected", "version": "1.19.0", "lessThan": "1.19.5", "versionType": "semver"}, {"status": "affected", "version": "1.20.0", "lessThan": "1.20.3", "versionType": "semver"}], "packageURL": "pkg:hex/plug", "packageName": "plug", "programFiles": ["lib/plug/parsers/multipart.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"}]}, {"cpes": ["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"], "repo": "https://github.com/elixir-plug/plug", "vendor": "elixir-plug", "modules": ["'Elixir.Plug.Parsers.MULTIPART'"], "product": "plug", "versions": [{"status": "affected", "changes": [{"at": "981597d3a4271ede64373c7a731702a42c500dd6", "status": "unaffected"}, {"at": "56edca2ce35fe5589cd581644d8a4493fa5f484e", "status": "unaffected"}, {"at": "0ee8afcc61466dc5f7a8f048d0632c899165b81f", "status": "unaffected"}, {"at": "cae36053350e5215a4e0ca33cd130af9c5fc6364", "status": "unaffected"}, {"at": "f7effaed811c00b5f5bf817936bfd9c5df27b7dc", "status": "unaffected"}, {"at": "df97d3f17f808a9916a7700a701fb85314559d56", "status": "unaffected"}], "version": "c52b2f32c90bccd718202bafccb5f95594e30183", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/elixir-plug/plug", "packageName": "elixir-plug/plug", "programFiles": ["lib/plug/parsers/multipart.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"}]}], "references": [{"url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-56814.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-56814", "tags": ["related"]}, {"url": "https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6", "tags": ["patch"]}, {"url": "https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e", "tags": ["patch"]}, {"url": "https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f", "tags": ["patch"]}, {"url": "https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364", "tags": ["patch"]}, {"url": "https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc", "tags": ["patch"]}, {"url": "https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56", "tags": ["patch"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.\n\nBecause every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.\n\nThis vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.\n\nThis issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3.", "supportingMedia": [{"type": "text/html", "value": "<p><tt>Plug.Parsers.MULTIPART</tt>, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its <tt>:length</tt> budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the <tt>:length</tt> limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.</p><p>Because every part whose <tt>Content-Disposition</tt> carries a non-empty <tt>filename</tt> creates a fresh temporary file (via <tt>Plug.Upload</tt>) and retains a <tt>Plug.Upload</tt> struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured <tt>:length</tt> limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using <tt>Plug.Parsers</tt> with the <tt>:multipart</tt> parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.</p><p>This vulnerability is associated with program files <tt>lib/plug/parsers/multipart.ex</tt> and program routines <tt>Plug.Parsers.MULTIPART.parse_multipart/2</tt>, <tt>Plug.Parsers.MULTIPART.parse_multipart_headers/5</tt>, <tt>Plug.Parsers.MULTIPART.parse_multipart_body/4</tt>, and <tt>Plug.Parsers.MULTIPART.parse_multipart_file/4</tt>.</p><p>This issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of Resources Without Limits or Throttling"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.16.6", "versionStartIncluding": "1.4.0"}, {"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.17.4", "versionStartIncluding": "1.17.0"}, {"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.18.5", "versionStartIncluding": "1.18.0"}, {"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.19.5", "versionStartIncluding": "1.19.0"}, {"criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.20.3", "versionStartIncluding": "1.20.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-07-10T11:14:35.574Z"}}}, "cveMetadata": {"cveId": "CVE-2026-56814", "state": "PUBLISHED", "dateUpdated": "2026-07-10T14:03:28.156Z", "dateReserved": "2026-06-23T12:29:02.507Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-07-10T11:14:35.574Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Plug.Parsers.MULTIPART'"], "packageName": "plug", "packageURL": "pkg:hex/plug", "product": "plug", "programFiles": ["lib/plug/parsers/multipart.ex"], "programRoutines": [{"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"}], "repo": "https://github.com/elixir-plug/plug", "vendor": "elixir-plug", "versions": [{"lessThan": "1.16.6", "status": "affected", "version": "1.4.0-rc.0", "versionType": "semver"}, {"lessThan": "1.17.4", "status": "affected", "version": "1.17.0", "versionType": "semver"}, {"lessThan": "1.18.5", "status": "affected", "version": "1.18.0", "versionType": "semver"}, {"lessThan": "1.19.5", "status": "affected", "version": "1.19.1", "versionType": "semver"}, {"lessThan": "1.20.3", "status": "affected", "version": "1.20.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Plug.Parsers.MULTIPART'"], "packageName": "elixir-plug/plug", "packageURL": "pkg:github/elixir-plug/plug", "product": "plug", "programFiles": ["lib/plug/parsers/multipart.ex"], "programRoutines": [{"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"}, {"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"}], "repo": "https://github.com/elixir-plug/plug", "vendor": "elixir-plug", "versions": [{"changes": [{"at": "981597d3a4271ede64373c7a731702a42c500dd6", "status": "unaffected"}, {"at": "56edca2ce35fe5589cd581644d8a4493fa5f484e", "status": "unaffected"}, {"at": "0ee8afcc61466dc5f7a8f048d0632c899165b81f", "status": "unaffected"}, {"at": "cae36053350e5215a4e0ca33cd130af9c5fc6364", "status": "unaffected"}, {"at": "f7effaed811c00b5f5bf817936bfd9c5df27b7dc", "status": "unaffected"}, {"at": "df97d3f17f808a9916a7700a701fb85314559d56", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "c52b2f32c90bccd718202bafccb5f95594e30183", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.\n\nBecause every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.\n\nThis vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.\n\nThis issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3."}, {"lang": "es", "value": "Plug.Parsers.MULTIPART, el analizador de cuerpo de solicitud multipart utilizado para manejar cargas de archivos y formularios multipart, no aplica su presupuesto de :length contra todos los recursos consumidos, permitiendo a un atacante remoto no autenticado causar denegaci\u00f3n de servicio. El analizador cobra el l\u00edmite de :length solo por los bytes del cuerpo de la parte; los bytes del encabezado de la parte nunca se cuentan, y una parte con un cuerpo vac\u00edo cuesta cero.\n\nDebido a que cada parte cuyo Content-Disposition lleva un nombre de archivo no vac\u00edo crea un archivo temporal nuevo (a trav\u00e9s de Plug.Upload) y retiene una estructura Plug.Upload durante la duraci\u00f3n de la solicitud, un atacante puede enviar una \u00fanica solicitud compuesta de muchas partes de archivo con cuerpo vac\u00edo. Dicha solicitud se mantiene muy por debajo del l\u00edmite de :length configurado (8,000,000 bytes por defecto) mientras crea un archivo temporal por parte, lo que lleva al agotamiento de inodos y disco y a un crecimiento ilimitado de la memoria. Cualquier aplicaci\u00f3n que utilice Plug.Parsers con el analizador :multipart se ve afectada, y no se requiere autenticaci\u00f3n, solo la accesibilidad de un punto final multipart a trav\u00e9s de HTTP.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/plug/parsers/multipart.ex y las rutinas de programa Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4 y Plug.Parsers.MULTIPART.parse_multipart_file/4.\n\nEste problema afecta a plug: desde 1.4.0 antes de 1.16.6, desde 1.17.0 antes de 1.17.4, desde 1.18.0 antes de 1.18.5, desde 1.19.0 antes de 1.19.5 y desde 1.20.0 antes de 1.20.3."}], "id": "CVE-2026-56814", "lastModified": "2026-10-24T23:10:00.160", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56814", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-10T14:03:11.744626Z", "version": "2.0.3"}}]}, "published": "2026-07-10T12:17:24.837", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-56814.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-plug/plug/commit/c52b2f32c90bccd718202bafccb5f95594e30183"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-56814"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.4.0,1.16.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.17.0,1.17.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.18.0,1.18.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.19.0,1.19.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.20.0,1.20.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "plug", "source": "cna", "vendor": "elixir-plug"}, "product": "plug", "vendor": "elixir-plug"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c52b2f32c90bccd718202bafccb5f95594e30183,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "plug", "source": "cna", "vendor": "elixir-plug"}, "product": "plug", "vendor": "elixir-plug"}], "created": "2026-07-10T16:15:03.388619+00:00", "updated": "2026-09-26T08:15:10.386396+00:00", "vendors": ["elixir-plug", "elixir-plug$PRODUCT$plug"]}