---
id: CVE-2026-56813
title: >-
  Improper Neutralization of Parameter/Argument Delimiters vulnerability in
  elixir-plug plug allows an attacker to inject or override HTTP cookie
  attributes.


  The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the
  S…
summary: >-
  Improper Neutralization of Parameter/Argument Delimiters vulnerability in
  elixir-plug plug allows an attacker to inject or override HTTP cookie
  attributes.


  The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the
  S…
severity: low
cvss: 2.1
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N'
cwe:
  - CWE-141
vendor: elixir-plug
product: plug
affected:
  - plug >= 0.1.0 < 1.16.6
  - plug >= 1.17.0 < 1.17.4
  - plug >= 1.18.0 < 1.18.5
  - plug >= 1.19.1 < 1.19.5
  - plug >= 1.20.0 < 1.20.3
  - elixir-plug/plug >= f26876aa67aaeb38e616638aa3efbcc2fe2906a5 < *
published: '2026-07-10'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T22:17:00.960'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56813'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-56813.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-plug/plug/commit/149d9ed68fee0b4f77efd1e835ce5d785856697b
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-plug/plug/commit/3f00dfad4e20ba88472e315c90a25742bf178f8e
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-plug/plug/commit/4167981747fe9ce75f374b94a28861ae950ea992
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-plug/plug/commit/a6d1248659022749869963fd302687165ecf8c8b
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-plug/plug/commit/eceb8315ce9a31ef784943a95a8624ebd1bc7e06
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-plug/plug/commit/f26876aa67aaeb38e616638aa3efbcc2fe2906a5
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-56813'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
tags:
  - nvd
  - cve.org
epss: 0.00216
epssPercentile: 0.10671
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-10T14:43:36.298825Z'
cvssSource: cna
ingestedAt: '2026-09-24T21:52:59.782Z'
---

## Overview

Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.

The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes.

An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented.

This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.