{"api_version":"1","generated_at":"2026-07-10T18:11:35+00:00","cve":"CVE-2026-56813","urls":{"html":"https://cve.report/CVE-2026-56813","api":"https://cve.report/api/cve/CVE-2026-56813.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-56813","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-56813"},"summary":{"title":"Cookie attribute injection in Plug.Conn.Cookies.encode/2","description":"Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\n\nThe Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ';' delimiter that separates cookie attributes.\n\nAn application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ';' to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ';' is not prevented.\n\nThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3.","state":"PUBLISHED","assigner":"EEF","published_at":"2026-07-10 13:16:20","updated_at":"2026-07-10 17:56:00"},"problem_types":["CWE-141","CWE-141 CWE-141 Improper Neutralization of Parameter/Argument Delimiters"],"metrics":[{"version":"4.0","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","score":"2.1","severity":"LOW","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"2.1","severity":"LOW","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","data":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":2.1,"baseSeverity":"LOW","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW"}}],"references":[{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-56813","name":"https://osv.dev/vulnerability/EEF-CVE-2026-56813","refsource":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/elixir-plug/plug/commit/c6575800b2c4e15af1904df87522ca8a23da020c","name":"https://github.com/elixir-plug/plug/commit/c6575800b2c4e15af1904df87522ca8a23da020c","refsource":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cna.erlef.org/cves/CVE-2026-56813.html","name":"https://cna.erlef.org/cves/CVE-2026-56813.html","refsource":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm","name":"https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm","refsource":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56813","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56813","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"elixir-plug","product":"plug","version":"affected 0.1.0 1.16.6 semver","platforms":[]},{"source":"CNA","vendor":"elixir-plug","product":"plug","version":"affected 1.17.0 1.17.4 semver","platforms":[]},{"source":"CNA","vendor":"elixir-plug","product":"plug","version":"affected 1.18.0 1.18.5 semver","platforms":[]},{"source":"CNA","vendor":"elixir-plug","product":"plug","version":"affected 1.19.0 1.19.5 semver","platforms":[]},{"source":"CNA","vendor":"elixir-plug","product":"plug","version":"affected 1.20.0 1.20.3 semver","platforms":[]},{"source":"CNA","vendor":"elixir-plug","product":"plug","version":"affected f26876aa67aaeb38e616638aa3efbcc2fe2906a5 * git","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Validate or reject the ';' delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Peter Ullrich","lang":"en"},{"source":"CNA","value":"José Valim","lang":"en"},{"source":"CNA","value":"Jonatan Männchen","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-56813","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-07-10T14:43:36.298825Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-07-10T14:43:45.849Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://repo.hex.pm","cpes":["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Plug.Conn.Cookies'","'Elixir.Plug.Conn'"],"packageName":"plug","packageURL":"pkg:hex/plug","product":"plug","programFiles":["lib/plug/conn/cookies.ex"],"programRoutines":[{"name":"'Elixir.Plug.Conn.Cookies':encode/2"},{"name":"'Elixir.Plug.Conn':put_resp_cookie/4"}],"repo":"https://github.com/elixir-plug/plug","vendor":"elixir-plug","versions":[{"lessThan":"1.16.6","status":"affected","version":"0.1.0","versionType":"semver"},{"lessThan":"1.17.4","status":"affected","version":"1.17.0","versionType":"semver"},{"lessThan":"1.18.5","status":"affected","version":"1.18.0","versionType":"semver"},{"lessThan":"1.19.5","status":"affected","version":"1.19.0","versionType":"semver"},{"lessThan":"1.20.3","status":"affected","version":"1.20.0","versionType":"semver"}]},{"collectionURL":"https://github.com","cpes":["cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","modules":["'Elixir.Plug.Conn.Cookies'","'Elixir.Plug.Conn'"],"packageName":"elixir-plug/plug","packageURL":"pkg:github/elixir-plug/plug","product":"plug","programFiles":["lib/plug/conn/cookies.ex"],"programRoutines":[{"name":"'Elixir.Plug.Conn.Cookies':encode/2"},{"name":"'Elixir.Plug.Conn':put_resp_cookie/4"}],"repo":"https://github.com/elixir-plug/plug","vendor":"elixir-plug","versions":[{"changes":[{"at":"3f00dfad4e20ba88472e315c90a25742bf178f8e","status":"unaffected"},{"at":"a6d1248659022749869963fd302687165ecf8c8b","status":"unaffected"},{"at":"4167981747fe9ce75f374b94a28861ae950ea992","status":"unaffected"},{"at":"149d9ed68fee0b4f77efd1e835ce5d785856697b","status":"unaffected"},{"at":"eceb8315ce9a31ef784943a95a8624ebd1bc7e06","status":"unaffected"}],"lessThan":"*","status":"affected","version":"f26876aa67aaeb38e616638aa3efbcc2fe2906a5","versionType":"git"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.16.6","versionStartIncluding":"0.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.17.4","versionStartIncluding":"1.17.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.18.5","versionStartIncluding":"1.18.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.19.5","versionStartIncluding":"1.19.0","vulnerable":true},{"criteria":"cpe:2.3:a:elixir-plug:plug:*:*:*:*:*:*:*:*","versionEndExcluding":"1.20.3","versionStartIncluding":"1.20.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}],"credits":[{"lang":"en","type":"finder","value":"Peter Ullrich"},{"lang":"en","type":"remediation developer","value":"José Valim"},{"lang":"en","type":"analyst","value":"Jonatan Männchen"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.</p><p>The <tt>Plug.Conn.Cookies.encode/2</tt> function in <tt>lib/plug/conn/cookies.ex</tt> builds the <tt>Set-Cookie</tt> response header by interpolating the cookie value and its <tt>path</tt>, <tt>domain</tt>, <tt>same_site</tt>, and <tt>extra</tt> attributes directly into the header without neutralizing the <tt>;</tt> delimiter that separates cookie attributes.</p><p>An application that places attacker-controlled data into a cookie value or attribute (for example via <tt>Plug.Conn.put_resp_cookie/4</tt> when reflecting a username or preference) lets an attacker inject a <tt>;</tt> to append or override cookie attributes (such as <tt>Domain</tt> and <tt>Path</tt> scope, or dropping the <tt>Secure</tt> and <tt>HttpOnly</tt> flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by <tt>Plug.Conn</tt> header validation, so HTTP response splitting is not possible, but attribute injection through <tt>;</tt> is not prevented.</p><p>This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3.</p>"}],"value":"Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\n\nThe Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ';' delimiter that separates cookie attributes.\n\nAn application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ';' to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ';' is not prevented.\n\nThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3."}],"impacts":[{"capecId":"CAPEC-61","descriptions":[{"lang":"en","value":"CAPEC-61 Session Fixation"}]}],"metrics":[{"cvssV4_0":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"LOCAL","baseScore":2.1,"baseSeverity":"LOW","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-141","description":"CWE-141 Improper Neutralization of Parameter/Argument Delimiters","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-07-10T14:45:34.174Z","orgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","shortName":"EEF"},"references":[{"tags":["vendor-advisory","related"],"url":"https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm"},{"tags":["related"],"url":"https://cna.erlef.org/cves/CVE-2026-56813.html"},{"tags":["related"],"url":"https://osv.dev/vulnerability/EEF-CVE-2026-56813"},{"tags":["patch"],"url":"https://github.com/elixir-plug/plug/commit/c6575800b2c4e15af1904df87522ca8a23da020c"}],"source":{"discovery":"EXTERNAL"},"title":"Cookie attribute injection in Plug.Conn.Cookies.encode/2","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Validate or reject the <tt>;</tt> delimiter in any untrusted data before passing it as a cookie value or attribute to <tt>Plug.Conn.put_resp_cookie/4</tt> or <tt>Plug.Conn.Cookies.encode/2</tt>. Carriage return, line feed, and null bytes are already rejected by <tt>Plug.Conn</tt> header validation.</p>"}],"value":"Validate or reject the ';' delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation."}],"x_generator":{"engine":"cvelib 1.8.0"}}},"cveMetadata":{"assignerOrgId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","assignerShortName":"EEF","cveId":"CVE-2026-56813","datePublished":"2026-07-10T12:51:08.758Z","dateReserved":"2026-06-23T12:29:02.507Z","dateUpdated":"2026-07-10T14:45:34.174Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-10 13:16:20","lastModifiedDate":"2026-07-10 17:56:00","problem_types":["CWE-141","CWE-141 CWE-141 Improper Neutralization of Parameter/Argument Delimiters"],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-10T14:43:36.298825Z","id":"CVE-2026-56813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"56813","Ordinal":"1","Title":"Cookie attribute injection in Plug.Conn.Cookies.encode/2","CVE":"CVE-2026-56813","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"56813","Ordinal":"1","NoteData":"Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.\n\nThe Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ';' delimiter that separates cookie attributes.\n\nAn application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ';' to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ';' is not prevented.\n\nThis issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3.","Type":"Description","Title":"Cookie attribute injection in Plug.Conn.Cookies.encode/2"}]}}}