CVE-2026-56814: plug 1.4.0-rc.0 to before 1.16.6, 1.17.0 to before 1.17.4, 1.18.0 to before 1.18.5, 1.19.1 to before 1.19.5, 1.20.0 to…

Affected technology

plug · 1.4.0-rc.0 to before 1.16.6, 1.17.0 to before 1.17.4, 1.18.0 to before 1.18.5, 1.19.1 to before 1.19.5, 1.20.0 to before 1.20.3
elixir-plug

plug · c52b2f32c90bccd718202bafccb5f95594e30183 to before *; status changes: 981597d3a4271ede64373c7a731702a42c500dd6 — unaffected, 56edca2ce35fe5589cd581644d8a4493fa5f484e — unaffected, 0ee8afcc61466dc5f7a8f048d0632c899165b81f — unaffected, cae36053350e5215a4e0ca33cd130af9c5fc6364 — unaffected, f7effaed811c00b5f5bf817936bfd9c5df27b7dc — unaffected, df97d3f17f808a9916a7700a701fb85314559d56 — unaffected
elixir-plug

Component: 'Elixir.Plug.Parsers.MULTIPART'
Function: 'Elixir.Plug.Parsers.MULTIPART':parse_multipart/2, 'Elixir.Plug.Parsers.MULTIPART':parse_multipart_headers/5, 'Elixir.Plug.Parsers.MULTIPART':parse_multipart_body/4, 'Elixir.Plug.Parsers.MULTIPART':parse_multipart_file/4
File: lib/plug/parsers/multipart.ex

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated remote attacker can cause denial of service. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and integrity impact as none; availability impact as low.