These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-56813 is a LOW severity vulnerability in elixir-plug plug affecting data confidentiality. The Plug.Conn.Cookies.encode/2 function builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ';' delimiter that separates cookie attributes. This could lead to attribute injection throug [truncated]
CVE-2026-56814 is a denial of service vulnerability in Plug.Parsers.MULTIPART, a multipart request-body parser used to handle file uploads and multipart forms. The parser does not enforce its :length budget against all consumed resources, allowing an unauthenticated remote attacker to cause denial of service. The vulnerability affects any application using Plug.Parsers with the :multipart parser, and no a [truncated]
CVE-2026-54892 is a high-severity vulnerability in Plug's nested-parameter decoder. An unauthenticated remote attacker can exploit this issue to cause a denial of service. The vulnerability arises from inefficient algorithmic complexity in the decoder, which can lead to a denial of service when a key contains many bracketed segments. This issue affects plug from 1.15.0 before 1.15.5, 1.16.4, 1.17.2, 1.18. [truncated]
CVE-2026-32688 is a high-severity denial-of-service issue in elixir-plug plug_cowboy. In affected versions, HTTP/2 request handling can turn attacker-controlled :scheme values into atoms, permanently consuming entries in the BEAM atom table until the node aborts with system_limit. HTTP/1.1 is not affected by the described path.