Plug Framework Quadratic Complexity Denial of Service via CVE-2026-54892

The Elixir Plug library (specifically the Plug.Conn.Query module) contains a performance vulnerability stemming from quadratic-time complexity during the decoding of nested query or body parameters. When parsing URL-encoded keys with deep bracket nesting (e.g., a[a][a]...=1), the library performs repetitive map operations and prefix hashing that scale at O(N^2) relative to the nesting depth.

Because the Plug.Parsers component accepts application/x-www-form-urlencoded payloads up to the configured global body limit (defaulting to 20 MB), an attacker can inject hundreds of thousands of nesting levels in a single request. This behavior pins a BEAM scheduler for minutes. By sending a small number of concurrent requests, an attacker can exhaust all available schedulers, rendering the entire Elixir or Phoenix application unresponsive. The vulnerability affects multiple versions across the 1.15.x to 1.19.x branches. Defenders should prioritize updating to the patched versions provided in the security advisory.

Attack Chain

1. Attacker crafts an HTTP POST request targeting an endpoint handled by the Plug framework.
2. Attacker sets the Content-Type header to application/x-www-form-urlencoded.
3. Attacker populates the request body with a parameter string featuring extreme bracket nesting (e.g., millions of [a] segments).
4. The Plug Plug.Parsers.URLENCODED parser accepts the payload as a valid body within the default 20MB limit.
5. Plug.Conn.Query.decode/4 initiates recursive parsing of the nested query keys.
6. The Plug.Conn.Query.split_keys/6 and insert_keys/3 functions perform quadratic operations while hashing the growing key prefixes.
7. The BEAM scheduler becomes pinned by the CPU-intensive decoding process.
8. Concurrent requests exhaust the scheduler pool, resulting in application-wide denial of service.

Impact

Successful exploitation allows an unauthenticated remote attacker to cause a complete denial of service for any internet-facing web application built on the Plug framework (including Phoenix). No specialized knowledge of the target application structure or authentication is required. A single low-bandwidth sender can stall application processing, affecting availability for all legitimate users.

Recommendation

• Upgrade the Plug library immediately to the patched versions: 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3.
• Audit application configurations for Plug.Parsers to restrict length and query_length limits to the minimum necessary for expected traffic.
• Deploy web application firewall (WAF) rules to detect and drop requests with excessive bracket nesting depth in query strings or POST bodies.
• Monitor application performance metrics for sustained, high CPU utilization on BEAM schedulers initiated by short-duration, high-payload requests.