CVE-2026-56814 - Vulnerability Details

- Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

Description

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.

Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.

This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.

This issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3.

Published: 2026-07-10

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Plug.Parsers.MULTIPART fails to count header bytes against theuthenticated attacker to send a multipart request with many empty‑body file parts that only the body is charged but header bytes are ignored, the payload can stay well below the configured length limit (default 8,000,000 bytes) while creating an unlimited number of temp files for each part, exhausting inodes, disk space, and memory. The flaw is a moderate severity denial of service impact identified as CWE‑770.

Affected Systems

The vulnerability affects the elixir-plug Plug library from versions 1.4.0 up to 1.20.2. Specifically, versions 1.4.0‑1.16.5, 1.17.0‑1.17.3, 1.18.0‑1.18.4, 1.19.0‑1.19.4, and 1.20.0‑1.20.2 are vulnerable. Any Elixir application that uses Plug.Parsers with the :multipart parser at its default configuration is impacted, regardless of authentication.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk, and the EPSS score is < 1%, indicating low exploitation probability, while the lack of KEV listing suggests the exploit is not widely reported. However, the attack requires only HTTP reachability to a multipart endpoint with no authentication, making it an of traffic to such endpoints and the potential for resource exhaustion in their environment.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

elixir-plug

plug

unaffected

Version	Status	Constraints
`1.4.0`	affected	< 1.16.6
`1.17.0`	affected	< 1.17.4
`1.18.0`	affected	< 1.18.5
`1.19.0`	affected	< 1.19.5
`1.20.0`	affected	< 1.20.3

elixir-plug

plug

unaffected

Version	Status	Constraints
`c52b2f32c90bccd718202bafccb5f95594e30183`	affected	< *

No data.

Vendor Product Confidence Versions

Elixir-plug

Plug

95%

Version	Status	Scheme	Platform
`[1.4.0,1.16.6)`	affected	semver	—
`[1.17.0,1.17.4)`	affected	semver	—
`[1.18.0,1.18.5)`	affected	semver	—
`[1.19.0,1.19.5)`	affected	semver	—
`[1.20.0,1.20.3)`	affected	semver	—

Elixir-plug

Plug

95%

Version	Status	Scheme	Platform
`[c52b2f32c90bccd718202bafccb5f95594e30183,*]`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Plug library to the latest stable release, at least 1.16.6, 1.17.4, 1.18.5, 1.19.5, or 1.20.3 or newer, depending on your current major version.
Verify that any endpoints that do not require multipart uploads are removed or disabled, thereby limiting the surface area for this attack.
Ensure system limits for disk, and consider temporary file cleanup jobs to mitigate accidental exhaustion.

Generated by OpenCVE AI on July 29, 2026 at 11:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00579.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-56814.html
https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f
https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e
https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6
https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364
https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56
https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc
https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63
https://osv.dev/vulnerability/EEF-CVE-2026-56814

History

Fri, 10 Jul 2026 14:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 10 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero. Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP. This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4. This issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3.
Title		Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)
First Time appeared		Elixir-plug Elixir-plug plug
Weaknesses		CWE-770
CPEs		cpe:2.3:a:elixir-plug:plug::::::::
Vendors & Products		Elixir-plug Elixir-plug plug
References		https://cna.erlef.org/cves/CVE-2026-56814.html https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6 https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364 https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56 https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63 https://osv.dev/vulnerability/EEF-CVE-2026-56814
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

Elixir-plug Plug

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-07-10T11:14:35.574Z

Updated: 2026-07-10T14:41:43.299Z

Reserved: 2026-06-23T12:29:02.507Z

Link: CVE-2026-56814

Vulnrichment

Updated: 2026-07-10T14:03:24.796Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-29T11:15:04Z

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object