3 matches found
GHSA-J43X-5HJQ-RGXF Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Summary Plug's nested-parameter decoder Plug.Conn.Query parses URL-encoded keys in time quadratic in their bracket-nesting depth. Any unauthenticated remote attacker that can reach a Plug-based HTTP endpoint can pin a BEAM scheduler for minutes with a single small request. Details For a key like...
Plug: quadratic-time decoding of nested query/body parameters enables denial of service
Summary Plug's nested-parameter decoder Plug.Conn.Query parses URL-encoded keys in time quadratic in their bracket-nesting depth. Any unauthenticated remote attacker that can reach a Plug-based HTTP endpoint can pin a BEAM scheduler for minutes with a single small request. Details For a key like...