{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-56813", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-06-23T12:29:02.507Z", "datePublished": "2026-07-10T12:51:08.758Z", "dateUpdated": "2026-09-24T21:30:13.749Z" }, "containers": { "cna": { "affected": [ { "collectionURL": "https://repo.hex.pm", "cpes": [ "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "'Elixir.Plug.Conn.Cookies'", "'Elixir.Plug.Conn'" ], "packageName": "plug", "packageURL": "pkg:hex/plug", "product": "plug", "programFiles": [ "lib/plug/conn/cookies.ex" ], "programRoutines": [ { "name": "'Elixir.Plug.Conn.Cookies':encode/2" }, { "name": "'Elixir.Plug.Conn':put_resp_cookie/4" } ], "repo": "https://github.com/elixir-plug/plug", "vendor": "elixir-plug", "versions": [ { "lessThan": "1.16.6", "status": "affected", "version": "0.1.0", "versionType": "semver" }, { "lessThan": "1.17.4", "status": "affected", "version": "1.17.0", "versionType": "semver" }, { "lessThan": "1.18.5", "status": "affected", "version": "1.18.0", "versionType": "semver" }, { "lessThan": "1.19.5", "status": "affected", "version": "1.19.1", "versionType": "semver" }, { "lessThan": "1.20.3", "status": "affected", "version": "1.20.0", "versionType": "semver" } ] }, { "collectionURL": "https://github.com", "cpes": [ "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "'Elixir.Plug.Conn.Cookies'", "'Elixir.Plug.Conn'" ], "packageName": "elixir-plug/plug", "packageURL": "pkg:github/elixir-plug/plug", "product": "plug", "programFiles": [ "lib/plug/conn/cookies.ex" ], "programRoutines": [ { "name": "'Elixir.Plug.Conn.Cookies':encode/2" }, { "name": "'Elixir.Plug.Conn':put_resp_cookie/4" } ], "repo": "https://github.com/elixir-plug/plug", "vendor": "elixir-plug", "versions": [ { "changes": [ { "at": "3f00dfad4e20ba88472e315c90a25742bf178f8e", "status": "unaffected" }, { "at": "a6d1248659022749869963fd302687165ecf8c8b", "status": "unaffected" }, { "at": "4167981747fe9ce75f374b94a28861ae950ea992", "status": "unaffected" }, { "at": "149d9ed68fee0b4f77efd1e835ce5d785856697b", "status": "unaffected" }, { "at": "eceb8315ce9a31ef784943a95a8624ebd1bc7e06", "status": "unaffected" } ], "lessThan": "*", "status": "affected", "version": "f26876aa67aaeb38e616638aa3efbcc2fe2906a5", "versionType": "git" } ] } ], "cpeApplicability": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.16.6", "versionStartIncluding": "0.1.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.17.4", "versionStartIncluding": "1.17.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.18.5", "versionStartIncluding": "1.18.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.19.5", "versionStartIncluding": "1.19.1", "vulnerable": true }, { "criteria": "cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.20.3", "versionStartIncluding": "1.20.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "credits": [ { "lang": "en", "type": "finder", "value": "Peter Ullrich" }, { "lang": "en", "type": "remediation developer", "value": "José Valim" }, { "lang": "en", "type": "analyst", "value": "Jonatan Männchen / EEF" } ], "datePublic": "2026-07-10T12:51:08.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.

\n

The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes.

\n

An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented.

\n

This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.

" }, { "base64": false, "type": "text/markdown", "value": "Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\n\nThe `Plug.Conn.Cookies.encode/2` function in `lib/plug/conn/cookies.ex` builds the `Set-Cookie` response header by interpolating the cookie value and its `path`, `domain`, `same_site`, and `extra` attributes directly into the header without neutralizing the `;` delimiter that separates cookie attributes.\n\nAn application that places attacker-controlled data into a cookie value or attribute (for example via `Plug.Conn.put_resp_cookie/4` when reflecting a username or preference) lets an attacker inject a `;` to append or override cookie attributes (such as `Domain` and `Path` scope, or dropping the `Secure` and `HttpOnly` flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by `Plug.Conn` header validation, so HTTP response splitting is not possible, but attribute injection through `;` is not prevented.\n\nThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3." } ], "value": "Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\n\nThe Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes.\n\nAn application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented.\n\nThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3." } ], "impacts": [ { "capecId": "CAPEC-61", "descriptions": [ { "lang": "en", "value": "CAPEC-61 Session Fixation" } ] } ], "metrics": [ { "cvssV4_0": { "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "baseScore": 2.1, "baseSeverity": "LOW", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-141", "description": "CWE-141 Improper Neutralization of Parameter/Argument Delimiters", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-24T21:30:13.749Z" }, "references": [ { "tags": [ "vendor-advisory", "related" ], "url": "https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm" }, { "name": "EEF CNA record for CVE-2026-56813", "tags": [ "related" ], "url": "https://cna.erlef.org/cves/CVE-2026-56813.html" }, { "name": "OSV record EEF-CVE-2026-56813", "tags": [ "related" ], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-56813" }, { "name": "Introducing commit f26876a in elixir-plug/plug", "tags": [ "related" ], "url": "https://github.com/elixir-plug/plug/commit/f26876aa67aaeb38e616638aa3efbcc2fe2906a5" }, { "name": "Fix commit 3f00dfa in elixir-plug/plug", "tags": [ "patch" ], "url": "https://github.com/elixir-plug/plug/commit/3f00dfad4e20ba88472e315c90a25742bf178f8e" }, { "name": "Fix commit a6d1248 in elixir-plug/plug", "tags": [ "patch" ], "url": "https://github.com/elixir-plug/plug/commit/a6d1248659022749869963fd302687165ecf8c8b" }, { "name": "Fix commit 4167981 in elixir-plug/plug", "tags": [ "patch" ], "url": "https://github.com/elixir-plug/plug/commit/4167981747fe9ce75f374b94a28861ae950ea992" }, { "name": "Fix commit 149d9ed in elixir-plug/plug", "tags": [ "patch" ], "url": "https://github.com/elixir-plug/plug/commit/149d9ed68fee0b4f77efd1e835ce5d785856697b" }, { "name": "Fix commit eceb831 in elixir-plug/plug", "tags": [ "patch" ], "url": "https://github.com/elixir-plug/plug/commit/eceb8315ce9a31ef784943a95a8624ebd1bc7e06" } ], "source": { "discovery": "EXTERNAL" }, "title": "Cookie attribute injection in Plug.Conn.Cookies.encode/2", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Validate or reject the ; delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation.

" }, { "base64": false, "type": "text/markdown", "value": "Validate or reject the `;` delimiter in any untrusted data before passing it as a cookie value or attribute to `Plug.Conn.put_resp_cookie/4` or `Plug.Conn.Cookies.encode/2`. Carriage return, line feed, and null bytes are already rejected by `Plug.Conn` header validation." } ], "value": "Validate or reject the ; delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation." } ] }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-07-10T14:43:36.298825Z", "id": "CVE-2026-56813", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-10T14:43:45.849Z" } } ] } }