CVE-2026-8468 is a resource exhaustion vulnerability (CWE-770) in the elixir-plug plug library's multipart header parsing code. The vulnerable function accumulates incoming multipart header bytes into a binary buffer without enforcing an upper size limit. An attacker can send a multipart/form-data request with incomplete or malformed headers that prevent the parser from completing, causing unbounded memory growth in the server process. This can lead to denial of service by exhausting BEAM virtual machine memory. The issue affects plug versions from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2. The vulnerability is related to a similar issue in the underlying cowboy library (CVE-2026-8466). No official patch or remediation guidance is currently documented.

An unauthenticated attacker can exploit this vulnerability to cause a denial of service by forcing the server to allocate increasing amounts of memory during multipart header parsing. This can exhaust the BEAM virtual machine memory, potentially leading to server crashes or degraded performance. No direct code execution or data disclosure is indicated. The impact is limited to denial of service via resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing request size limits or timeouts at the application or proxy level to mitigate unbounded memory consumption during multipart parsing. Monitor for updates from the elixir-plug project regarding patches or official mitigations.