{"id":"CVE-2026-56813","state":"PUBLISHED","title":"Cookie attribute injection in Plug.Conn.Cookies.encode/2","description":"Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\n\nThe Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes.\n\nAn application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented.\n\nThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.","publishedAt":"2026-07-10T12:51:08.758Z","updatedAt":"2026-09-24T21:30:13.749Z","severity":{"score":2.1,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","source":"EEF"},"assigner":"EEF","products":["elixir-plug plug"],"affected":[{"vendor":"elixir-plug","product":"plug","packageName":"plug","packageURL":"pkg:hex/plug","defaultStatus":"unaffected","versions":[{"version":"0.1.0","status":"affected","lessThan":"1.16.6","versionType":"semver"},{"version":"1.17.0","status":"affected","lessThan":"1.17.4","versionType":"semver"},{"version":"1.18.0","status":"affected","lessThan":"1.18.5","versionType":"semver"},{"version":"1.19.1","status":"affected","lessThan":"1.19.5","versionType":"semver"},{"version":"1.20.0","status":"affected","lessThan":"1.20.3","versionType":"semver"}],"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Plug.Conn.Cookies'","'Elixir.Plug.Conn'"],"programFiles":["lib/plug/conn/cookies.ex"],"programRoutines":[{"name":"'Elixir.Plug.Conn.Cookies':encode/2"},{"name":"'Elixir.Plug.Conn':put_resp_cookie/4"}],"repo":"https://github.com/elixir-plug/plug"},{"vendor":"elixir-plug","product":"plug","packageName":"elixir-plug/plug","packageURL":"pkg:github/elixir-plug/plug","defaultStatus":"unaffected","versions":[{"version":"f26876aa67aaeb38e616638aa3efbcc2fe2906a5","status":"affected","lessThan":"*","changes":[{"at":"3f00dfad4e20ba88472e315c90a25742bf178f8e","status":"unaffected"},{"at":"a6d1248659022749869963fd302687165ecf8c8b","status":"unaffected"},{"at":"4167981747fe9ce75f374b94a28861ae950ea992","status":"unaffected"},{"at":"149d9ed68fee0b4f77efd1e835ce5d785856697b","status":"unaffected"},{"at":"eceb8315ce9a31ef784943a95a8624ebd1bc7e06","status":"unaffected"}],"versionType":"git"}],"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Plug.Conn.Cookies'","'Elixir.Plug.Conn'"],"programFiles":["lib/plug/conn/cookies.ex"],"programRoutines":[{"name":"'Elixir.Plug.Conn.Cookies':encode/2"},{"name":"'Elixir.Plug.Conn':put_resp_cookie/4"}],"repo":"https://github.com/elixir-plug/plug"}],"references":["https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm","https://cna.erlef.org/cves/CVE-2026-56813.html","https://osv.dev/vulnerability/EEF-CVE-2026-56813","https://github.com/elixir-plug/plug/commit/f26876aa67aaeb38e616638aa3efbcc2fe2906a5","https://github.com/elixir-plug/plug/commit/3f00dfad4e20ba88472e315c90a25742bf178f8e","https://github.com/elixir-plug/plug/commit/a6d1248659022749869963fd302687165ecf8c8b","https://github.com/elixir-plug/plug/commit/4167981747fe9ce75f374b94a28861ae950ea992","https://github.com/elixir-plug/plug/commit/149d9ed68fee0b4f77efd1e835ce5d785856697b","https://github.com/elixir-plug/plug/commit/eceb8315ce9a31ef784943a95a8624ebd1bc7e06"],"weaknesses":["CWE-141"],"ingestedAt":"2026-10-29T20:12:24.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/56xxx/CVE-2026-56813.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-56813","state":"PUBLISHED","datePublished":"2026-07-10T12:51:08.758Z","dateUpdated":"2026-09-24T21:30:13.749Z","assignerShortName":"EEF","assignerOrgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","dateReserved":"2026-06-23T12:29:02.507Z"},"containers":{"cna":{"title":"Cookie attribute injection in Plug.Conn.Cookies.encode/2","descriptions":[{"lang":"en","value":"Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\n\nThe Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes.\n\nAn application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented.\n\nThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3."}],"affected":[{"vendor":"elixir-plug","product":"plug","packageName":"plug","packageURL":"pkg:hex/plug","defaultStatus":"unaffected","versions":[{"version":"0.1.0","status":"affected","lessThan":"1.16.6","versionType":"semver"},{"version":"1.17.0","status":"affected","lessThan":"1.17.4","versionType":"semver"},{"version":"1.18.0","status":"affected","lessThan":"1.18.5","versionType":"semver"},{"version":"1.19.1","status":"affected","lessThan":"1.19.5","versionType":"semver"},{"version":"1.20.0","status":"affected","lessThan":"1.20.3","versionType":"semver"}],"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Plug.Conn.Cookies'","'Elixir.Plug.Conn'"],"programFiles":["lib/plug/conn/cookies.ex"],"programRoutines":[{"name":"'Elixir.Plug.Conn.Cookies':encode/2"},{"name":"'Elixir.Plug.Conn':put_resp_cookie/4"}],"repo":"https://github.com/elixir-plug/plug"},{"vendor":"elixir-plug","product":"plug","packageName":"elixir-plug/plug","packageURL":"pkg:github/elixir-plug/plug","defaultStatus":"unaffected","versions":[{"version":"f26876aa67aaeb38e616638aa3efbcc2fe2906a5","status":"affected","lessThan":"*","changes":[{"at":"3f00dfad4e20ba88472e315c90a25742bf178f8e","status":"unaffected"},{"at":"a6d1248659022749869963fd302687165ecf8c8b","status":"unaffected"},{"at":"4167981747fe9ce75f374b94a28861ae950ea992","status":"unaffected"},{"at":"149d9ed68fee0b4f77efd1e835ce5d785856697b","status":"unaffected"},{"at":"eceb8315ce9a31ef784943a95a8624ebd1bc7e06","status":"unaffected"}],"versionType":"git"}],"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"],"modules":["'Elixir.Plug.Conn.Cookies'","'Elixir.Plug.Conn'"],"programFiles":["lib/plug/conn/cookies.ex"],"programRoutines":[{"name":"'Elixir.Plug.Conn.Cookies':encode/2"},{"name":"'Elixir.Plug.Conn':put_resp_cookie/4"}],"repo":"https://github.com/elixir-plug/plug"}],"references":[{"url":"https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm","tags":["vendor-advisory","related"]},{"url":"https://cna.erlef.org/cves/CVE-2026-56813.html","name":"EEF CNA record for CVE-2026-56813","tags":["related"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-56813","name":"OSV record EEF-CVE-2026-56813","tags":["related"]},{"url":"https://github.com/elixir-plug/plug/commit/f26876aa67aaeb38e616638aa3efbcc2fe2906a5","name":"Introducing commit f26876a in elixir-plug/plug","tags":["related"]},{"url":"https://github.com/elixir-plug/plug/commit/3f00dfad4e20ba88472e315c90a25742bf178f8e","name":"Fix commit 3f00dfa in elixir-plug/plug","tags":["patch"]},{"url":"https://github.com/elixir-plug/plug/commit/a6d1248659022749869963fd302687165ecf8c8b","name":"Fix commit a6d1248 in elixir-plug/plug","tags":["patch"]},{"url":"https://github.com/elixir-plug/plug/commit/4167981747fe9ce75f374b94a28861ae950ea992","name":"Fix commit 4167981 in elixir-plug/plug","tags":["patch"]},{"url":"https://github.com/elixir-plug/plug/commit/149d9ed68fee0b4f77efd1e835ce5d785856697b","name":"Fix commit 149d9ed in elixir-plug/plug","tags":["patch"]},{"url":"https://github.com/elixir-plug/plug/commit/eceb8315ce9a31ef784943a95a8624ebd1bc7e06","name":"Fix commit eceb831 in elixir-plug/plug","tags":["patch"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":2.1,"baseSeverity":"LOW","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-141","description":"CWE-141 Improper Neutralization of Parameter/Argument Delimiters","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"EEF","orgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","dateUpdated":"2026-09-24T21:30:13.749Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.16.6","versionStartIncluding":"0.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.17.4","versionStartIncluding":"1.17.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.5","versionStartIncluding":"1.18.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.19.5","versionStartIncluding":"1.19.1","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.20.3","versionStartIncluding":"1.20.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}],"credits":[{"lang":"en","type":"finder","value":"Peter Ullrich"},{"lang":"en","type":"remediation developer","value":"José Valim"},{"lang":"en","type":"analyst","value":"Jonatan Männchen / EEF"}],"datePublic":"2026-07-10T12:51:08.000Z","impacts":[{"capecId":"CAPEC-61","descriptions":[{"lang":"en","value":"CAPEC-61 Session Fixation"}]}],"source":{"discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Validate or reject the <code>;</code> delimiter in any untrusted data before passing it as a cookie value or attribute to <code>Plug.Conn.put_resp_cookie/4</code> or <code>Plug.Conn.Cookies.encode/2</code>. Carriage return, line feed, and null bytes are already rejected by <code>Plug.Conn</code> header validation.</p>"},{"base64":false,"type":"text/markdown","value":"Validate or reject the `;` delimiter in any untrusted data before passing it as a cookie value or attribute to `Plug.Conn.put_resp_cookie/4` or `Plug.Conn.Cookies.encode/2`. Carriage return, line feed, and null bytes are already rejected by `Plug.Conn` header validation."}],"value":"Validate or reject the ; delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation."}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-10T14:43:36.298825Z","id":"CVE-2026-56813","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-10T14:43:45.849Z"}}]}}}