Skip to content
Heist/ feed
Low

Cookie attribute injection in Plug.Conn.Cookies.encode/2

Type: advisorySource: Official CVE List1 source record

Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes. An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented. This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.

Announced Source revision 1
Original source ↗

CVE-2026-56813

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-56813

plug

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

plug

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/elixir-plug/plug",
    "vendor": "elixir-plug",
    "modules": [
      "'Elixir.Plug.Conn.Cookies'",
      "'Elixir.Plug.Conn'"
    ],
    "product": "plug",
    "versions": [
      {
        "status": "affected",
        "version": "0.1.0",
        "lessThan": "1.16.6",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.17.0",
        "lessThan": "1.17.4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.18.0",
        "lessThan": "1.18.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.19.1",
        "lessThan": "1.19.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.20.0",
        "lessThan": "1.20.3",
        "versionType": "semver"
      }
    ],
    "packageURL": "pkg:hex/plug",
    "packageName": "plug",
    "programFiles": [
      "lib/plug/conn/cookies.ex"
    ],
    "collectionURL": "https://repo.hex.pm",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Plug.Conn.Cookies':encode/2"
      },
      {
        "name": "'Elixir.Plug.Conn':put_resp_cookie/4"
      }
    ]
  },
  {
    "cpes": [
      "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
    ],
    "repo": "https://github.com/elixir-plug/plug",
    "vendor": "elixir-plug",
    "modules": [
      "'Elixir.Plug.Conn.Cookies'",
      "'Elixir.Plug.Conn'"
    ],
    "product": "plug",
    "versions": [
      {
        "status": "affected",
        "changes": [
          {
            "at": "3f00dfad4e20ba88472e315c90a25742bf178f8e",
            "status": "unaffected"
          },
          {
            "at": "a6d1248659022749869963fd302687165ecf8c8b",
            "status": "unaffected"
          },
          {
            "at": "4167981747fe9ce75f374b94a28861ae950ea992",
            "status": "unaffected"
          },
          {
            "at": "149d9ed68fee0b4f77efd1e835ce5d785856697b",
            "status": "unaffected"
          },
          {
            "at": "eceb8315ce9a31ef784943a95a8624ebd1bc7e06",
            "status": "unaffected"
          }
        ],
        "version": "f26876aa67aaeb38e616638aa3efbcc2fe2906a5",
        "lessThan": "*",
        "versionType": "git"
      }
    ],
    "packageURL": "pkg:github/elixir-plug/plug",
    "packageName": "elixir-plug/plug",
    "programFiles": [
      "lib/plug/conn/cookies.ex"
    ],
    "collectionURL": "https://github.com",
    "defaultStatus": "unaffected",
    "programRoutines": [
      {
        "name": "'Elixir.Plug.Conn.Cookies':encode/2"
      },
      {
        "name": "'Elixir.Plug.Conn':put_resp_cookie/4"
      }
    ]
  }
]
Related CVEs
CVE-2026-56813

Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event
#1937 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement