Answer in brief
CVE-2026-56814 records a Medium severity (CVSS 6.9) vulnerability in Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service). The current sources do not mark it as known exploited. The current feed maps elixir-plug/elixir-plug/plug (generic), elixir-plug/plug (generic), elixir-plug/plug (generic), elixir-plug/plug (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps elixir-plug/elixir-plug/plug (generic), elixir-plug/plug (generic), elixir-plug/plug (generic), elixir-plug/plug (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| elixir-plug/elixir-plug/pluggeneric | >=c52b2f32c90bccd718202bafccb5f95594e30183 <* | * |
| elixir-plug/pluggeneric | >=1.4.0 <1.16.6 || >=1.17.0 <1.17.4 || >=1.18.0 <1.18.5 || >=1.19.0 <1.19.5 || >=1.20.0 <1.20.3 | 1.16.6, 1.17.4, 1.18.5, 1.19.5, 1.20.3 |
| elixir-plug/pluggeneric | >=c52b2f32c90bccd718202bafccb5f95594e30183 <* | * |
| elixir-plug/pluggeneric | >=1.4.0-rc.0 <1.16.6 || >=1.17.0 <1.17.4 || >=1.18.0 <1.18.5 || >=1.19.1 <1.19.5 || >=1.20.0 <1.20.3 | 1.16.6, 1.17.4, 1.18.5, 1.19.5, 1.20.3 |
Published upstream
Jul 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 10, 2026
Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero. Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP. This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4. This issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.
Quoted source text, attributed separately from HOL analysis.