EEF-CVE-2026-56813

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-56813.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-56813.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-56813
Aliases
Published
2026-07-10T12:51:08.758Z
Modified
2026-07-10T14:45:34.174Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Cookie attribute injection in Plug.Conn.Cookies.encode/2
Details

Summary

Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.

The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ';' delimiter that separates cookie attributes.

An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ';' to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ';' is not prevented.

This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3.

Workaround

Validate or reject the ';' delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation.

Database specific 
{
    "cwe_ids": [
        "CWE-141"
    ],
    "capec_ids": [
        "CAPEC-61"
    ],
    "cpe_ids": [
        "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"
    ]
}
References
Credits
    • Peter Ullrich - FINDER
    • José Valim - REMEDIATION_DEVELOPER
    • Jonatan Männchen - ANALYST

Affected packages

Hex / plug

Package

Name
plug
Purl
pkg:hex/plug

Affected ranges

Type
SEMVER
Events
Introduced
0.1.0
Fixed
1.16.6
Type
SEMVER
Events
Introduced
1.17.0
Fixed
1.17.4
Type
SEMVER
Events
Introduced
1.18.0
Fixed
1.18.5
Type
SEMVER
Events
Introduced
1.19.0
Fixed
1.19.5
Type
SEMVER
Events
Introduced
1.20.0
Fixed
1.20.3

Affected versions

0.*
0.4.1
0.4.2
0.4.3
0.4.4
0.5.0
0.5.1
0.5.2
0.5.3
0.6.0
0.7.0
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.9.0
0.10.0
0.11.0
0.11.1
0.11.2
0.11.3
0.12.0
0.12.1
0.12.2
0.13.0
0.13.1
0.14.0
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9
1.2.0-rc.0
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.4.0-rc.0
1.4.0
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5.0-rc.0
1.5.0-rc.1
1.5.0-rc.2
1.5.0
1.5.1
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.8.2
1.8.3
1.9.0
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4
1.11.0
1.11.1
1.12.0
1.12.1
1.13.0
1.13.1
1.13.2
1.13.3
1.13.4
1.13.5
1.13.6
1.14.0
1.14.1
1.14.2
1.15.0
1.15.1
1.15.2
1.15.3
1.15.4
1.15.5
1.15.6
1.16.0
1.16.1
1.16.2
1.16.3
1.16.4
1.16.5
1.17.0
1.17.1
1.17.2
1.17.3
1.18.0
1.18.1
1.18.2
1.18.3
1.18.4
1.19.0
1.19.1
1.19.2
1.19.3
1.19.4
1.20.0
1.20.1
1.20.2

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-56813.json"

Git / github.com/elixir-plug/plug

Affected ranges

Type
GIT
Repo
https://github.com/elixir-plug/plug
Events
Introduced
f26876aa67aaeb38e616638aa3efbcc2fe2906a5
Fixed
3f00dfad4e20ba88472e315c90a25742bf178f8e
Fixed
a6d1248659022749869963fd302687165ecf8c8b
Fixed
4167981747fe9ce75f374b94a28861ae950ea992
Fixed
149d9ed68fee0b4f77efd1e835ce5d785856697b
Fixed
eceb8315ce9a31ef784943a95a8624ebd1bc7e06

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-56813.json"