elixir-plug has 3 CVEs on record. 1 was published in the last 90 days. The median CVSS is 5.1 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.1
- Publish → KEV
- —
- Last 90 days
- 1 prev 2
Worst active — by depth score
CVE-2026-56814Medium· 6.9Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of…38CVE-2026-105963Medium· 5.1Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments28CVE-2026-56813Low· 2.1Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the S…12
elixir-plug vulnerabilities
CVEs affecting elixir-plug, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-105963Medium· 5.1Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug plug_crypto allows an unauthenticated remote attacker to expose the secret key base through application logs via a wrong-type…
CVE-2026-56814Medium· 6.9Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of…
Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of…
CVE-2026-56813Low· 2.1Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the S…
Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the S…