CVE-2026-56814

MEDIUMPre-NVD 6.96.9—
EchelonGraph scoreMEDIUM confidence

This medium-severity CVE scores 6.9 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.6%, top 56% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: epss, secondary
6.9EG
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS PROB: 1%CVSS: 6.9Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part body bytes; part header bytes are never counted, and a part with an empty body costs zero.

Because every part whose Content-Disposition carries a non-empty filename creates a fresh temporary file (via Plug.Upload) and retains a Plug.Upload struct for the duration of the request, an attacker can send a single request composed of many empty-body file parts. Such a request stays well under the configured :length limit (8,000,000 bytes by default) while creating one temporary file per part, leading to inode and disk exhaustion and unbounded memory growth. Any application using Plug.Parsers with the :multipart parser is affected, and no authentication is required, only reachability of a multipart endpoint over HTTP.

This vulnerability is associated with program files lib/plug/parsers/multipart.ex and program routines Plug.Parsers.MULTIPART.parse_multipart/2, Plug.Parsers.MULTIPART.parse_multipart_headers/5, Plug.Parsers.MULTIPART.parse_multipart_body/4, and Plug.Parsers.MULTIPART.parse_multipart_file/4.

This issue affects plug: from 1.4.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, and from 1.20.0 before 1.20.3.

CVSS v3
6.9
EG Score
6.9(medium)
EG Risk
46(Track)
EG Risk 46/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity69% × 45%
Exploitation1% × 40%
Automatability100% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
1%
EPSS %ILE
44%
KEV
Not listed

Published

July 10, 2026

Last Modified

July 10, 2026

Advisory Details (9)

Auto-updated Jul 10, 2026
Patch available. Sources: github, github_commit.
generic

OSV - Open Source Vulnerabilities

https://osv.dev/vulnerability/EEF-CVE-2026-56814
github Patch Available

Multipart `:length` limit is not charged for file uploads · Advisory · elixir-plug/plug · GitHub

https://github.com/elixir-plug/plug/security/advisories/GHSA-95qv-c9g9-rm63
github_commit

commit f7effaed811c (elixir-plug/plug)

Fix landed in elixir-plug/plug commit f7effaed811c — awaiting tagged release

https://github.com/elixir-plug/plug/commit/f7effaed811c00b5f5bf817936bfd9c5df27b7dc
github_commit

commit df97d3f17f80 (elixir-plug/plug)

Fix landed in elixir-plug/plug commit df97d3f17f80 — awaiting tagged release

https://github.com/elixir-plug/plug/commit/df97d3f17f808a9916a7700a701fb85314559d56
github_commit

commit cae36053350e (elixir-plug/plug)

Fix landed in elixir-plug/plug commit cae36053350e — awaiting tagged release

https://github.com/elixir-plug/plug/commit/cae36053350e5215a4e0ca33cd130af9c5fc6364
github_commit

commit 981597d3a427 (elixir-plug/plug)

Fix landed in elixir-plug/plug commit 981597d3a427 — awaiting tagged release

https://github.com/elixir-plug/plug/commit/981597d3a4271ede64373c7a731702a42c500dd6
github_commit

commit 56edca2ce35f (elixir-plug/plug)

Fix landed in elixir-plug/plug commit 56edca2ce35f — awaiting tagged release

https://github.com/elixir-plug/plug/commit/56edca2ce35fe5589cd581644d8a4493fa5f484e
github_commit

commit 0ee8afcc6146 (elixir-plug/plug)

Fix landed in elixir-plug/plug commit 0ee8afcc6146 — awaiting tagged release

https://github.com/elixir-plug/plug/commit/0ee8afcc61466dc5f7a8f048d0632c899165b81f
generic

Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) | Erlang Ecosystem Foundation CNA

https://cna.erlef.org/cves/CVE-2026-56814.html

Affected Packages

(1 across 1 ecosystem)
Hex(1)
PackageVulnerable rangeFixed inDependents
plug1.10.0 ... 1.9.0 (73 versions)1.20.3—

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Data Freshness Timeline

(refreshed 12× in last 7d / 27× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-07-26 14:54 UTCEPSS rescore
  2. 2026-07-26 14:54 UTCEPSS rescore
  3. 2026-07-26 12:13 UTCEG score recompute
  4. 2026-07-25 14:18 UTCEPSS rescore
  5. 2026-07-25 14:18 UTCEPSS rescore
  6. 2026-07-24 14:18 UTCEPSS rescore
  7. 2026-07-24 14:18 UTCEPSS rescore
  8. 2026-07-23 14:18 UTCEPSS rescore
  9. 2026-07-23 03:20 UTCEG score recompute
  10. 2026-07-22 14:08 UTCEPSS rescore
  11. 2026-07-21 15:25 UTCEPSS rescore
  12. 2026-07-20 17:08 UTCEPSS rescore
  13. 2026-07-19 14:31 UTCEPSS rescore
  14. 2026-07-19 14:31 UTCEPSS rescore
  15. 2026-07-19 02:29 UTCEPSS rescore
  16. 2026-07-18 10:04 UTCEPSS rescore
  17. 2026-07-16 17:03 UTCEPSS rescore
  18. 2026-07-15 16:57 UTCEPSS rescore
  19. 2026-07-15 16:57 UTCEPSS rescore
  20. 2026-07-15 02:00 UTCEPSS rescore
  21. 2026-07-15 02:00 UTCEPSS rescore
  22. 2026-07-13 22:31 UTCEPSS rescore
  23. 2026-07-13 06:13 UTCEPSS rescore
  24. 2026-07-13 06:13 UTCEPSS rescore
  25. 2026-07-12 05:46 UTCEPSS rescore
Show 2 more
  1. 2026-07-10 12:13 UTCEG score recompute
  2. 2026-07-10 12:12 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-56814?
CVE-2026-56814 is a medium vulnerability published on July 10, 2026. Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The parser charges the :length limit only for part…
When was CVE-2026-56814 disclosed?
CVE-2026-56814 was first published in the National Vulnerability Database on July 10, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-56814 actively exploited?
CVE-2026-56814 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 1% probability of exploitation in the next 30 days, which ranks it in the top 55.8% of all scored CVEs.
What is the CVSS score of CVE-2026-56814?
CVE-2026-56814 has a CVSS v3 base score of 6.9 (NVD).
How do I remediate CVE-2026-56814?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-56814, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-56814

Explore →

Is Your Infrastructure Affected by CVE-2026-56814?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs