{"vulnerability": "CVE-2026-54892", "sightings": [{"uuid": "67473346-3cf9-4b36-9538-6ac98636ff59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54892", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxl5ook3g2a", "content": "CVE-2026-54892 - Plug: quadratic-time decoding of nested query/body parameters enables denial of service\nCVE ID : CVE-2026-54892\n \n Published : 23 juin 2026 12:31 | 1\u00a0heure, 12\u00a0minutes ago\n \n Description : Inefficient algorithmic complexity in Plug's nested-parameter decoder a...", "creation_timestamp": "2026-06-23T14:07:25.908341Z"}, {"uuid": "888e37ab-ad0e-44d1-a496-922f1d96572e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54892", "type": "seen", "source": "https://gist.github.com/alon710/979d7d899727637e6e9c2c6d617956b2", "content": "# CVE-2026-54892: CVE-2026-54892: Algorithmic Complexity Denial of Service in Plug Query Decoder\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54892\n\n## Summary\nAn algorithmic complexity vulnerability (CWE-407) in the query decoder of the Elixir Plug library (CVE-2026-54892) allows unauthenticated remote attackers to trigger scheduler starvation and denial of service by transmitting deeply nested brackets in query parameters or URL-encoded post bodies.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust Erlang VM schedulers and cause a Denial of Service via deeply nested parameter keys in URL-encoded requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7\n- **Affected Component**: Plug.Conn.Query.decode/4\n- **Exploit Status**: poc\n- **Remediation Status**: Patched\n\n## Affected Systems\n\n- Elixir Web Applications\n- Phoenix Framework Applications using Plug < 1.15.5, 1.16.4, 1.17.2, 1.18.3, or 1.19.3\n- **plug**: >= 1.15.0, < 1.15.5 (Fixed in: `1.15.5`)\n- **plug**: >= 1.16.0, < 1.16.4 (Fixed in: `1.16.4`)\n- **plug**: >= 1.17.0, < 1.17.2 (Fixed in: `1.17.2`)\n- **plug**: >= 1.18.0, < 1.18.3 (Fixed in: `1.18.3`)\n- **plug**: >= 1.19.0, < 1.19.3 (Fixed in: `1.19.3`)\n\n## Mitigation\n\n- Upgrade Plug dependency to safe version\n- Limit urlencoded request body size in endpoint config\n- Deploy WAF rule to block highly nested keys\n\n**Remediation Steps:**\n1. Open mix.exs and locate the :plug dependency declaration.\n2. Update the version constraint to use one of the patched versions: ~> 1.15.5, ~> 1.16.4, ~> 1.17.2, ~> 1.18.3, or ~> 1.19.3.\n3. Run `mix deps.get` followed by `mix deps.compile` to fetch and compile the secure version.\n4. Deploy the updated application to production environments.\n\n## References\n\n- [GHSA-j43x-5hjq-rgxf Security Advisory](https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf)\n- [NVD CVE-2026-54892 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-54892)\n- [Erlang Ecosystem Foundation Advisory](https://cna.erlef.org/cves/CVE-2026-54892.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54892) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T14:32:29.377771Z"}, {"uuid": "53dab9a6-2a86-4173-879e-b9c6532146db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54892", "type": "seen", "source": "https://bsky.app/profile/standup.thecompound.tech/post/3mw6xnfar242k", "content": "Plug is affected by CVE-2026-54892: nested query keys make Plug.Conn.Query decode in quadratic time, letting an unauthenticated request pin a BEAM scheduler. #software", "creation_timestamp": "2026-09-23T14:35:58.065546Z"}, {"uuid": "cb03f91a-91ba-414a-b6c5-69155596b9de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54892", "type": "published-proof-of-concept", "source": "https://github.com/elixir-plug/plug/security/advisories/GHSA-j43x-5hjq-rgxf", "content": "", "creation_timestamp": "2026-09-23T16:35:10.816588Z"}]}