Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)
Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero. Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP. This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4. This issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.
CVE-2026-56814
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-56814
plug
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
plug
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"cpes": [
"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/elixir-plug/plug",
"vendor": "elixir-plug",
"modules": [
"'Elixir.Plug.Parsers.MULTIPART'"
],
"product": "plug",
"versions": [
{
"status": "affected",
"version": "1.4.0-rc.0",
"lessThan": "1.16.6",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.17.0",
"lessThan": "1.17.4",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.18.0",
"lessThan": "1.18.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.19.1",
"lessThan": "1.19.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "1.20.0",
"lessThan": "1.20.3",
"versionType": "semver"
}
],
"packageURL": "pkg:hex/plug",
"packageName": "plug",
"programFiles": [
"lib/plug/parsers/multipart.ex"
],
"collectionURL": "https://repo.hex.pm",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"
}
]
},
{
"cpes": [
"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
],
"repo": "https://github.com/elixir-plug/plug",
"vendor": "elixir-plug",
"modules": [
"'Elixir.Plug.Parsers.MULTIPART'"
],
"product": "plug",
"versions": [
{
"status": "affected",
"changes": [
{
"at": "981597d3a4271ede64373c7a731702a42c500dd6",
"status": "unaffected"
},
{
"at": "56edca2ce35fe5589cd581644d8a4493fa5f484e",
"status": "unaffected"
},
{
"at": "0ee8afcc61466dc5f7a8f048d0632c899165b81f",
"status": "unaffected"
},
{
"at": "cae36053350e5215a4e0ca33cd130af9c5fc6364",
"status": "unaffected"
},
{
"at": "f7effaed811c00b5f5bf817936bfd9c5df27b7dc",
"status": "unaffected"
},
{
"at": "df97d3f17f808a9916a7700a701fb85314559d56",
"status": "unaffected"
}
],
"version": "c52b2f32c90bccd718202bafccb5f95594e30183",
"lessThan": "*",
"versionType": "git"
}
],
"packageURL": "pkg:github/elixir-plug/plug",
"packageName": "elixir-plug/plug",
"programFiles": [
"lib/plug/parsers/multipart.ex"
],
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"programRoutines": [
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4"
},
{
"name": "'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4"
}
]
}
]- Related CVEs
- CVE-2026-56814
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #1938 · Revision 1
- Added to Heist Feed
- Publisher date