Denial of Service

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)CVE-2026-56814elixir-plug · CVSS 6.9 · 1.1% likely

   CWE-770

2. Plug: quadratic-time decoding of nested query/body parameters enables denial of serviceCVE-2026-54892elixir-plug · CVSS 8.7 · 0.9% likely

   CWE-407

3. Unbounded buffer accumulation in multipart header parsing causes denial of service in plugCVE-2026-8468elixir-plug · CVSS 8.2 · 0.6% likely

   CWE-770

4. Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboyCVE-2026-32688elixir-plug · CVSS 8.7 · 0.5% likely

   CWE-770

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.