CVE-2026-8468Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing. 'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service. This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://nvd.nist.gov/vuln/detail/CVE-2026-8468

Full discourse1 post

White Rabbitx 🏴‍☠️@TheRabbitPy150d
Disclosure
🚨 New DoS in Elixir Plug (CVE-2026-8468) Unbounded buffer in multipart header parsing → memory exhaustion read_part_headers/2 ignores size limits, unlike read_part_body ✅ Unauth remote attack ✅ Affects plug < 1.15.4 / 1.16.3 / 1.17.1 / 1.18.2 / 1.19.2 Patch ASAP. 🔗 https://nvd.nist.gov/vuln/detail/CVE-2026-8468 #infosec #cve #elixir #appsec
Post summary
CVE-2026-8468 is a newly disclosed DoS vulnerability in Elixir Plug caused by an unbounded buffer in header parsing; the issue is acknowledged, a patch is pending, and no exploitation evidence is provided.
1001047
1.3K followersView on X

Explore more

Back to dashboard