plug_crypto
Crypto-related functionality for web applications, used by Plug.
View on Github
Activity
- Latest release
- 5d ago
- Total releases
- 15
- Cadence
- ~7 months
- Last 12 months
- 2
Reach
- Downloads
- 159.7M
- Stars
- 97
Details
- License
- Apache-2.0
- First release
- Oct 03, 2018
| Version | Released | |
|---|---|---|
2.2.1
patch
| ||
2.2.0
minor
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
2.1.1
patch
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
2.1.0
minor
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
2.0.0
major
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.2.5
patch
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.2.4
patch
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.2.3
patch
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.2.2
patch
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.2.1
patch
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.2.0
minor
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.1.2
patch
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.1.1
patch
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.1.0
minor
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev | ||
1.0.0
initial
1 CVE
CVE-2026-105963
EEF-CVE-2026-105963
GHSA-ffw9-w85g-f2vh
Oct 23, 2026
Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments
Medium
Network
Low
High
None
SummaryExternally-Generated Error Message Containing Sensitive Information vulnerability in Two entry points take request data. This issue affects plug: from 1.6.3 before 1.7.0; plug_crypto: from 1.0.0 before 2.2.1. Details1. Type checks in function-head guards. Every public function in 2. The VM builds the error, not the library. When no clause matches, the Erlang VM raises 3. Which value leaks. 4. The frame reaches logs and error trackers. Plug.Cowboy and Bandit write the formatted frame, arguments included, to the error log and attach it as Proof of concept
ImpactAn unauthenticated attacker sends one request with a wrong-typed parameter, or omits a header, and the secret key base or the compared secret is written into the application log and into WorkaroundsCheck argument types in the calling code before entering Where the leaked value matters more than the crash, configuring the error tracker to drop stack-frame arguments also keeps the secret out of the forwarded report. For Sentry this means not sending ConfigurationsRequest-data reachability needs an application that passes unvalidated request data into Affected versions
1.0.0
1.1.0
1.1.1
1.1.2
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
2.0.0
2.1.0
+ 2 more Show less
2.1.1
2.2.0
Fixed in
2.2.1
References
Updated Oct 23, 2026 · Source: OSV.dev |