Read the docs
TI-2026-40966 Aliases CVE-2026-56813

Cookie attribute injection in Plug.Conn.Cookies.encode/2

Priority LOW 11CWE-141Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes. An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented. This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00216 12th percentileScored 2026-11-07
Fix Fixed plug (elixir-plug): 1.16.6, 1.17.4, 1.18.5 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
elixir-plugplug0.1.0 to before 1.16.6; 1.17.0 to before 1.17.4; 1.18.0 to before 1.18.5; 1.19.1 to before 1.19.5; 1.20.0 to before 1.20.31.16.6, 1.17.4, 1.18.5, 1.19.5, 1.20.3Patch availableCNA
  • plug Vendorelixir-plug Affected 0.1.0 to before 1.16.6; 1.17.0 to before 1.17.4; 1.18.0 to before 1.18.5; 1.19.1 to before 1.19.5; 1.20.0 to before 1.20.3 Fixed in 1.16.6, 1.17.4, 1.18.5, 1.19.5, 1.20.3 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*——elixir-plug
  • cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:* Versions — — ·elixir-plug

Remediation

  • Fix · CNA plug (elixir-plug) Fixed in 1.16.6, 1.17.4, 1.18.5, 1.19.5, 1.20.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    elixir-plug plug 1.16.6, 1.17.4 and 3 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-40967 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)Priority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56813

References

Patch 5

Advisory 1

Other 3

  • TI-2026-39665 Plug: quadratic-time decoding of nested query/body parameters enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-25180 Atom table exhaustion via HTTP/2 :scheme pseudo-header in plug_cowboy CVSS 4.0HIGH 8.7
  • TI-2026-40967 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service) CVSS 4.0MEDIUM 6.9
  • TI-2026-07437 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug CVSS 4.0HIGH 8.2
  • TI-2026-79606 Secret key base leaks into logs via wrong-typed Plug.Crypto arguments CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences