{"metadata": {"vulnerability": "cve-2026-54892", "count": 16, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-06-16T10:47:13.915Z", "date_only": false, "value": "2026-06-16T10:47:13.915Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-54892", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-23T12:31:12.629Z", "date_only": false, "value": "2026-06-23T12:31:12.629Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-54892", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-23T13:03:58.893Z", "date_only": false, "value": "2026-06-23T13:03:58.893269Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-54892", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-23T13:03:58.893Z", "date_only": false, "value": "2026-06-23T13:03:58.893269Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54892", "record": "FKIE_CVE-2026-54892", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-23T13:04:27.014Z", "date_only": false, "value": "2026-06-23T13:04:27.014Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-54892", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-23T13:16:43Z", "date_only": false, "value": "2026-06-23T13:16:43Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J43X-5HJQ-RGXF", "record": "GHSA-J43X-5HJQ-RGXF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-23T13:16:43.167Z", "date_only": false, "value": "2026-06-23T13:16:43.167", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54892", "record": "FKIE_CVE-2026-54892", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-23T14:07:25.908Z", "date_only": false, "value": "2026-06-23T14:07:25.908341Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxl5ook3g2a", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "67473346-3cf9-4b36-9538-6ac98636ff59", "content": "CVE-2026-54892 - Plug: quadratic-time decoding of nested query/body parameters enables denial of service\nCVE ID : CVE-2026-54892\n \n Published : 23 juin 2026 12:31 | 1\u00a0heure, 12\u00a0minutes ago\n \n Description : Inefficient algorithmic complexity in Plug's nested-parameter decoder a...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxl5ook3g2a"}, {"timestamp": "2026-06-23T18:21:14.232Z", "date_only": false, "value": "2026-06-23T18:21:14.232Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-54892", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-23T18:21:14.232Z", "date_only": false, "value": "2026-06-23T18:21:14.232Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / EEF", "record": "cve-2026-54892", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-23T14:00:22Z", "date_only": false, "value": "2026-09-23T14:00:22Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J43X-5HJQ-RGXF", "record": "GHSA-J43X-5HJQ-RGXF", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-23T14:00:22Z", "date_only": false, "value": "2026-09-23T14:00:22Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J43X-5HJQ-RGXF", "record": "GHSA-J43X-5HJQ-RGXF", "field": "modified"}, {"timestamp": "2026-09-23T14:32:29.377Z", "date_only": false, "value": "2026-09-23T14:32:29.377771Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/979d7d899727637e6e9c2c6d617956b2", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "888e37ab-ad0e-44d1-a496-922f1d96572e", "content": "# CVE-2026-54892: CVE-2026-54892: Algorithmic Complexity Denial of Service in Plug Query Decoder\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54892\n\n## Summary\nAn algorithmic complexity vulnerability (CWE-407) in the query decoder of the Elixir Plug library (CVE-2026-54892) allows unauthenticated remote attackers to trigger scheduler starvation and denial of service by transmitting deeply nested brackets in query parameters or URL-encoded post bodies.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust Erlang VM schedulers and cause a Denial of Service via deeply nested parameter keys in URL-encoded requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7\n- **Affected Component**: Plug.Conn.Query.decode/4\n- **Exploit Status**: poc\n- **Remediation Status**: Patched\n\n## Affected Systems\n\n- Elixir Web Applications\n- Phoenix Framework Applications using Plug < 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3\n- **plug**: >= 1.15.0, < 1.15.5 (Fixed in: `1.15.5`)\n- **plug**: >= 1.16.0, < 1.16.4 (Fixed in: `1.16.4`)\n- **plug**: >= 1.17.0, < 1.17.2 (Fixed in: `1.17.2`)\n- **plug**: >= 1.18.0, < 1.18.3 (Fixed in: `1.18.3`)\n- **plug**: >= 1.19.0, < 1.19.3 (Fixed in: `1.19.3`)\n\n## Mitigation\n\n- Upgrade Plug dependency to safe version\n- Limit urlencoded request body size in endpoint config\n- Deploy WAF rule to block highly nested keys\n\n**Remediation Steps:**\n1. Open mix.exs and locate the :plug dependency declaration.\n2. Update the version constraint to use one of the patched versions: ~> 1.15.5, ~> 1.16.4, ~> 1.17.2, ~> 1.18.3, or ~> 1.19.3.\n3. Run `mix deps.get` followed by `mix deps.compile` to fetch and compile the secure version.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GHSA-j43x-5hjq-rgxf Security Advisory](https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf)\n- [NVD CVE-2026-54892 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-54892)\n- [Erlang Ecosystem Foundation Advisory](https://cna.erlef.org/cves/CVE-2026-54892.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54892) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/979d7d899727637e6e9c2c6d617956b2"}, {"timestamp": "2026-09-23T14:35:58.065Z", "date_only": false, "value": "2026-09-23T14:35:58.065546Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mw6xnfar242k", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "53dab9a6-2a86-4173-879e-b9c6532146db", "content": "Plug is affected by CVE-2026-54892: nested query keys make Plug.Conn.Query decode in quadratic time, letting an unauthenticated request pin a BEAM scheduler. #software", "url": "https://bsky.app/profile/standup.thecompound.tech/post/3mw6xnfar242k"}, {"timestamp": "2026-09-23T16:35:10.816Z", "date_only": false, "value": "2026-09-23T16:35:10.816588Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "cb03f91a-91ba-414a-b6c5-69155596b9de", "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-25T23:10:00.167Z", "date_only": false, "value": "2026-10-25T23:10:00.167", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54892", "record": "FKIE_CVE-2026-54892", "field": "lastModified"}], "metrics": {"as_of": "2026-10-31T00:41:10.564Z", "anchors": {"origin": {"timestamp": "2026-06-23T12:31:12.629Z", "date_only": false, "value": "2026-06-23T12:31:12.629Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-54892", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-06-23T12:31:12.629Z", "date_only": false, "value": "2026-06-23T12:31:12.629Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-54892", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-23T16:35:10.816Z", "date_only": false, "value": "2026-09-23T16:35:10.816588Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "cb03f91a-91ba-414a-b6c5-69155596b9de", "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 7963438.187, "hours": 2212.0661630555555, "days": 92.16942346064815, "min_seconds": 7963438.187, "max_seconds": 7963438.187, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-23T12:31:12.629Z", "date_only": false, "value": "2026-06-23T12:31:12.629Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-54892", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-23T16:35:10.816Z", "date_only": false, "value": "2026-09-23T16:35:10.816588Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "cb03f91a-91ba-414a-b6c5-69155596b9de", "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 11189397.935706, "hours": 3108.166093251667, "days": 129.5069205521528, "min_seconds": 11189397.935706, "max_seconds": 11189397.935706, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-23T12:31:12.629Z", "date_only": false, "value": "2026-06-23T12:31:12.629Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-54892", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T00:41:10.564Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 3225959.748706, "hours": 896.0999301961111, "days": 37.33749709150463, "min_seconds": 3225959.748706, "max_seconds": 3225959.748706, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-23T16:35:10.816Z", "date_only": false, "value": "2026-09-23T16:35:10.816588Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "record": "CVE-2026-54892", "field": "creation_timestamp", "uuid": "cb03f91a-91ba-414a-b6c5-69155596b9de", "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-31T00:41:10.564Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}