Inefficient Algorithmic Complexity Affecting plug package, versions >=1.15.0 <1.15.5>=1.16.0 <1.16.4>=1.17.0 <1.17.2>=1.18.0 <1.18.3>=1.19.0 <1.19.3
Threat Intelligence
Exploit Maturity
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Proof of Concept
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-HEX-PLUG-17430984
- published23 Jun 2026
- disclosed23 Jun 2026
- creditBraidon Whatley
Introduced: 23 Jun 2026
NewCVE-2026-54892 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade plug to version 1.15.5, 1.16.4, 1.17.2, 1.18.3, 1.19.3 or higher.
Overview
plug is a specification and conveniences for composable modules between web applications.
Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the nested-parameter decoder (Plug.Conn.Query). An attacker can exhaust server resources and render the application unresponsive by sending specially crafted requests with a large number of nested parameters.