CVE-2026-56813
Cookie attribute injection in Plug.Conn.Cookies.encode/2
- Published
- Updated
- Reserved
- Assigned by
- EEF
Description
Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes. An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented. This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.
Timeline
ID reserved
By EEF
- 17 days later
· 17 days later
Published
- 3 months later
· 3 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| EEFCNA (assigner) | 4.0 | Low2.1 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
| NVDNVD · Deferred | 4.0 | Low2.1 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.22% · top 88% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.1.
Weakness
Affected products
- affected 0.1.0 – < 1.16.6
- affected 1.17.0 – < 1.17.4
- affected 1.18.0 – < 1.18.5
- affected 1.19.1 – < 1.19.5
- affected 1.20.0 – < 1.20.3
- affected f26876aa67aaeb38e616638aa3efbcc2fe2906a5 – < *
What to do
Workaround: Validate or reject the ; delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation.
References (9)
- https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm (opens in a new tab)vendor-advisoryrelated
- EEF CNA record for CVE-2026-56813 (opens in a new tab)related
- OSV record EEF-CVE-2026-56813 (opens in a new tab)related
- Introducing commit f26876a in elixir-plug/plug (opens in a new tab)related
- Fix commit 3f00dfa in elixir-plug/plug (opens in a new tab)patch
- Fix commit a6d1248 in elixir-plug/plug (opens in a new tab)patch
- Fix commit 4167981 in elixir-plug/plug (opens in a new tab)patch
- Fix commit 149d9ed in elixir-plug/plug (opens in a new tab)patch
- Fix commit eceb831 in elixir-plug/plug (opens in a new tab)patch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-56813)Record last updated .