CVE-2026-54892 describes an inefficient algorithmic complexity vulnerability (CWE-407) in the Plug.Conn.Query.decode/4 and related functions of the elixir-plug library. The vulnerability arises when parsing query strings or application/x-www-form-urlencoded bodies containing keys with many bracketed segments (e.g., a[a][a][a]=1). The decoder performs a map operation for each nesting level, with the cost growing quadratically relative to the number of nesting levels. With the default body size limit, a single request can contain approximately 333,000 nesting levels, saturating a BEAM scheduler for minutes. Multiple concurrent requests can exhaust all schedulers, causing a denial of service. No authentication or route knowledge is required to exploit this. Affected versions include 1.15.0 before 1.15.5, 1.16.0 before 1.16.4, 1.17.0 before 1.17.2, 1.18.0 before 1.18.3, and 1.19.0 before 1.19.3.

An unauthenticated attacker can cause a denial of service by sending specially crafted requests with deeply nested parameters, leading to high CPU usage and server unresponsiveness. This affects availability of services using vulnerable plug versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patches are confirmed, consider limiting the maximum allowed nesting depth in request parameters or applying rate limiting to mitigate potential denial of service. Monitor vendor channels for official fixes.