All 5 CVE vulnerabilities found in plug, with AI-generated Chinese analysis, references, and POCs.
Vendor: elixir-plug
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-105963 | Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments CWE-532 | 5.1 | Medium | 2026-10-23 |
| CVE-2026-56813 | Cookie attribute injection in Plug.Conn.Cookies.encode/2 CWE-141 | 2.1 | Low | 2026-07-10 |
| CVE-2026-56814 | Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) CWE-770 | 6.9 | Medium | 2026-07-10 |
| CVE-2026-54892 | Plug: quadratic-time decoding of nested query/body parameters enables denial of service CWE-407 | - | - | 2026-06-23 |
| CVE-2026-8468 | Unbounded buffer accumulation in multipart header parsing causes denial of service in plug CWE-770 | - | - | 2026-05-14 |
All 5 known CVE vulnerabilities affecting plug with full Chinese analysis, references, and POCs where available.