{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/plug--1.17.0--1.17.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-54892"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Plug (\u003e= 1.15.0, \u003c 1.15.5)","Plug (\u003e= 1.16.0, \u003c 1.16.4)","Plug (\u003e= 1.17.0, \u003c 1.17.2)","Plug (\u003e= 1.18.0, \u003c 1.18.3)","Plug (\u003e= 1.19.0, \u003c 1.19.3)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Elixir Plug library (specifically the \u003ccode\u003ePlug.Conn.Query\u003c/code\u003e module) contains a performance vulnerability stemming from quadratic-time complexity during the decoding of nested query or body parameters. When parsing URL-encoded keys with deep bracket nesting (e.g., \u003ccode\u003ea[a][a]...=1\u003c/code\u003e), the library performs repetitive map operations and prefix hashing that scale at O(N^2) relative to the nesting depth.\u003c/p\u003e\n\u003cp\u003eBecause the \u003ccode\u003ePlug.Parsers\u003c/code\u003e component accepts \u003ccode\u003eapplication/x-www-form-urlencoded\u003c/code\u003e payloads up to the configured global body limit (defaulting to 20 MB), an attacker can inject hundreds of thousands of nesting levels in a single request. This behavior pins a BEAM scheduler for minutes. By sending a small number of concurrent requests, an attacker can exhaust all available schedulers, rendering the entire Elixir or Phoenix application unresponsive. The vulnerability affects multiple versions across the 1.15.x to 1.19.x branches. Defenders should prioritize updating to the patched versions provided in the security advisory.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts an HTTP POST request targeting an endpoint handled by the Plug framework.\u003c/li\u003e\n\u003cli\u003eAttacker sets the \u003ccode\u003eContent-Type\u003c/code\u003e header to \u003ccode\u003eapplication/x-www-form-urlencoded\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker populates the request body with a parameter string featuring extreme bracket nesting (e.g., millions of \u003ccode\u003e[a]\u003c/code\u003e segments).\u003c/li\u003e\n\u003cli\u003eThe Plug \u003ccode\u003ePlug.Parsers.URLENCODED\u003c/code\u003e parser accepts the payload as a valid body within the default 20MB limit.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ePlug.Conn.Query.decode/4\u003c/code\u003e initiates recursive parsing of the nested query keys.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ePlug.Conn.Query.split_keys/6\u003c/code\u003e and \u003ccode\u003einsert_keys/3\u003c/code\u003e functions perform quadratic operations while hashing the growing key prefixes.\u003c/li\u003e\n\u003cli\u003eThe BEAM scheduler becomes pinned by the CPU-intensive decoding process.\u003c/li\u003e\n\u003cli\u003eConcurrent requests exhaust the scheduler pool, resulting in application-wide denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated remote attacker to cause a complete denial of service for any internet-facing web application built on the Plug framework (including Phoenix). No specialized knowledge of the target application structure or authentication is required. A single low-bandwidth sender can stall application processing, affecting availability for all legitimate users.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Plug library immediately to the patched versions: 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3.\u003c/li\u003e\n\u003cli\u003eAudit application configurations for \u003ccode\u003ePlug.Parsers\u003c/code\u003e to restrict \u003ccode\u003elength\u003c/code\u003e and \u003ccode\u003equery_length\u003c/code\u003e limits to the minimum necessary for expected traffic.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to detect and drop requests with excessive bracket nesting depth in query strings or POST bodies.\u003c/li\u003e\n\u003cli\u003eMonitor application performance metrics for sustained, high CPU utilization on BEAM schedulers initiated by short-duration, high-payload requests.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-23T19:59:30Z","date_published":"2026-09-23T19:59:30Z","id":"https://feed.craftedsignal.io/briefs/2026-09-plug-dos/","summary":"An unauthenticated remote attacker can trigger a denial-of-service condition in Elixir applications using the Plug framework by submitting URL-encoded payloads with deeply nested brackets that consume excessive CPU cycles on the BEAM scheduler.","title":"Plug Framework Quadratic Complexity Denial of Service via CVE-2026-54892","url":"https://feed.craftedsignal.io/briefs/2026-09-plug-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Plug (\u003e= 1.17.0, \u003c 1.17.2)","version":"https://jsonfeed.org/version/1.1"}