CVE-2026-568146.9MediumCWE-770

CVE-2026-56814: Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)

elixir-plug · plug

Vendor fix available · Affected: elixir-plug plug · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.1%probability of exploitation in the next 30 days

65th percentile

050100

Higher than 65% of scored CVEs

6.9MediumCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero. Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP. This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4. This issue affects plug: from 1.4.0-rc.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.

Affected products2

From the CVE record. A product or version that is not listed is unknown, not unaffected.

elixir-plug · plugfrom 1.4.0-rc.0 before 1.16.6; from 1.17.0 before 1.17.4; from 1.18.0 before 1.18.5; from 1.19.1 before 1.19.5; from 1.20.0 before 1.20.3
elixir-plug · plugVersions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Allocation Without Limits · Denial of Service
Vendor: elixir-plug
Published: July 2026
Band: Possible (1 to 10%), July 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-56814 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.