Plug (>= 1.15.0, < 1.15.5)

An unauthenticated remote attacker can trigger a denial-of-service condition in Elixir applications using the Plug framework by submitting URL-encoded payloads with deeply nested brackets that consume excessive CPU cycles on the BEAM scheduler.