Skip to main content
cve.nowby Sazabi
← Hex
HexPackage

plug

8 known vulnerabilities (2 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 high, 2 medium, 1 low
Registry
Hex

Advisories 8

  • CVE-2026-105963Medium 5.1

    Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

    Affected: from 1.6.3, fixed in 1.7.0.

  • Cookie attribute injection in Plug.Conn.Cookies.encode/2

    Affected: from 0.1.0, fixed in 1.16.6; from 1.17.0, fixed in 1.17.4; from 1.18.0, fixed in 1.18.5; from 1.19.1, fixed in 1.19.5; from 1.20.0, fixed in 1.20.3.

  • CVE-2026-56814Medium 6.9

    Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

    Affected: from 1.4.0-rc.0, fixed in 1.16.6; from 1.17.0, fixed in 1.17.4; from 1.18.0, fixed in 1.18.5; from 1.19.1, fixed in 1.19.5; from 1.20.0, fixed in 1.20.3.

  • Plug: quadratic-time decoding of nested query/body parameters enables denial of service

    Affected: from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.4; from 1.17.0, fixed in 1.17.2; from 1.18.0, fixed in 1.18.3; from 1.19.0, fixed in 1.19.3; from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.4; from 1.17.0, fixed in 1.17.2; from 1.18.0, fixed in 1.18.3; from 1.19.0, fixed in 1.19.3; from 1.15.0, fixed in 1.15.5; from 1.16.0, fixed in 1.16.4; from 1.17.0, fixed in 1.17.2; from 1.18.0, fixed in 1.18.3; from 1.19.0, fixed in 1.19.3.

  • Unbounded buffer accumulation in multipart header parsing causes denial of service in plug

    Affected: from 1.4.0, fixed in 1.15.4; from 1.16.0, fixed in 1.16.3; from 1.17.0, fixed in 1.17.1; from 1.18.0, fixed in 1.18.2; from 1.19.0, fixed in 1.19.2; from 1.4.0, fixed in 1.15.4; from 1.16.0, fixed in 1.16.3; from 1.17.0, fixed in 1.17.1; from 1.18.0, fixed in 1.18.2; from 1.19.0, fixed in 1.19.2; from 1.4.0, fixed in 1.15.4; from 1.16.0, fixed in 1.16.3; from 1.17.0, fixed in 1.17.1; from 1.18.0, fixed in 1.18.2; from 1.19.0, fixed in 1.19.2.

  • Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can…

    Affected: fixed in 1.0.6; from 1.1.0, fixed in 1.1.9; from 1.2.0, fixed in 1.2.5; from 1.3.0, fixed in 1.3.5.

  • Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of…

    Affected: fixed in 1.0.4; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.3; from 1.3.0, fixed in 1.3.2.

  • Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow…

    Affected: fixed in 1.0.4; from 1.1.0, fixed in 1.1.7; from 1.2.0, fixed in 1.2.3; from 1.3.0, fixed in 1.3.2.