{"metadata": {"vulnerability": "CVE-2026-54892", "count": 16, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-06-16T10:47:13.915Z", "date_only": false, "value": "2026-06-16T10:47:13.915Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-54892", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-23T12:31:12.629Z", "date_only": false, "value": "2026-06-23T12:31:12.629Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54892", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-06-23T13:03:58.893Z", "date_only": false, "value": "2026-06-23T13:03:58.893269Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54892", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-23T13:03:58.893Z", "date_only": false, "value": "2026-06-23T13:03:58.893269Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54892", "record": "FKIE_CVE-2026-54892", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-23T13:04:27.014Z", "date_only": false, "value": "2026-06-23T13:04:27.014Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54892", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-23T13:16:43Z", "date_only": false, "value": "2026-06-23T13:16:43Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J43X-5HJQ-RGXF", "record": "GHSA-J43X-5HJQ-RGXF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-23T13:16:43.167Z", "date_only": false, "value": "2026-06-23T13:16:43.167", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54892", "record": "FKIE_CVE-2026-54892", "field": "published"}, {"timestamp": "2026-06-23T14:07:25.908Z", "date_only": false, "value": "2026-06-23T14:07:25.908341Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxl5ook3g2a", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "67473346-3cf9-4b36-9538-6ac98636ff59", "content": "CVE-2026-54892 - Plug: quadratic-time decoding of nested query/body parameters enables denial of service\nCVE ID : CVE-2026-54892\n \n Published : 23 juin 2026 12:31 | 1\u00a0heure, 12\u00a0minutes ago\n \n Description : Inefficient algorithmic complexity in Plug's nested-parameter decoder a...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxl5ook3g2a"}, {"timestamp": "2026-06-23T15:44:39.343Z", "date_only": false, "value": "2026-06-23T15:44:39.343", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54892", "record": "FKIE_CVE-2026-54892", "field": "lastModified"}, {"timestamp": "2026-06-23T18:21:14.232Z", "date_only": false, "value": "2026-06-23T18:21:14.232Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-54892", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-23T18:21:14.232Z", "date_only": false, "value": "2026-06-23T18:21:14.232Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / EEF", "record": "CVE-2026-54892", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T14:00:22Z", "date_only": false, "value": "2026-09-23T14:00:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J43X-5HJQ-RGXF", "record": "GHSA-J43X-5HJQ-RGXF", "field": "published"}, {"timestamp": "2026-09-23T14:00:22Z", "date_only": false, "value": "2026-09-23T14:00:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J43X-5HJQ-RGXF", "record": "GHSA-J43X-5HJQ-RGXF", "field": "modified"}, {"timestamp": "2026-09-23T14:32:29.377Z", "date_only": false, "value": "2026-09-23T14:32:29.377771Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/979d7d899727637e6e9c2c6d617956b2", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "888e37ab-ad0e-44d1-a496-922f1d96572e", "content": "# CVE-2026-54892: CVE-2026-54892: Algorithmic Complexity Denial of Service in Plug Query Decoder\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54892\n\n## Summary\nAn algorithmic complexity vulnerability (CWE-407) in the query decoder of the Elixir Plug library (CVE-2026-54892) allows unauthenticated remote attackers to trigger scheduler starvation and denial of service by transmitting deeply nested brackets in query parameters or URL-encoded post bodies.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust Erlang VM schedulers and cause a Denial of Service via deeply nested parameter keys in URL-encoded requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7\n- **Affected Component**: Plug.Conn.Query.decode/4\n- **Exploit Status**: poc\n- **Remediation Status**: Patched\n\n## Affected Systems\n\n- Elixir Web Applications\n- Phoenix Framework Applications using Plug < 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3\n- **plug**: >= 1.15.0, < 1.15.5 (Fixed in: `1.15.5`)\n- **plug**: >= 1.16.0, < 1.16.4 (Fixed in: `1.16.4`)\n- **plug**: >= 1.17.0, < 1.17.2 (Fixed in: `1.17.2`)\n- **plug**: >= 1.18.0, < 1.18.3 (Fixed in: `1.18.3`)\n- **plug**: >= 1.19.0, < 1.19.3 (Fixed in: `1.19.3`)\n\n## Mitigation\n\n- Upgrade Plug dependency to safe version\n- Limit urlencoded request body size in endpoint config\n- Deploy WAF rule to block highly nested keys\n\n**Remediation Steps:**\n1. Open mix.exs and locate the :plug dependency declaration.\n2. Update the version constraint to use one of the patched versions: ~> 1.15.5, ~> 1.16.4, ~> 1.17.2, ~> 1.18.3, or ~> 1.19.3.\n3. Run `mix deps.get` followed by `mix deps.compile` to fetch and compile the secure version.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GHSA-j43x-5hjq-rgxf Security Advisory](https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf)\n- [NVD CVE-2026-54892 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-54892)\n- [Erlang Ecosystem Foundation Advisory](https://cna.erlef.org/cves/CVE-2026-54892.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54892) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/979d7d899727637e6e9c2c6d617956b2"}, {"timestamp": "2026-09-23T14:35:58.065Z", "date_only": false, "value": "2026-09-23T14:35:58.065546Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mw6xnfar242k", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "53dab9a6-2a86-4173-879e-b9c6532146db", "content": "Plug is affected by CVE-2026-54892: nested query keys make Plug.Conn.Query decode in quadratic time, letting an unauthenticated request pin a BEAM scheduler. #software", "url": "https://bsky.app/profile/standup.thecompound.tech/post/3mw6xnfar242k"}, {"timestamp": "2026-09-23T16:35:10.816Z", "date_only": false, "value": "2026-09-23T16:35:10.816588Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "cb03f91a-91ba-414a-b6c5-69155596b9de", "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf"}]}