EEF-CVE-2026-56813 CVE-2026-56813 GHSA-wpmj-jh88-rpgm

Cookie attribute injection in Plug.Conn.Cookies.encode/2

Not rated yet Hex

Severity: 0.0 / 10; Unknown · CVSS 4.0
Exploit chance (EPSS): 0.22%; Chance of exploitation in the next 30 days. Higher than 11.99% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-141 Improper Neutralization of Parameter/Argument Delimiters
Fix: 1.20.3; Upgrade plug to this version or later

Description

Summary

Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.

The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes.

An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented.

This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.

Workarounds

Validate or reject the ; delimiter in any untrusted data before passing it as a cookie value or attribute to Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2. Carriage return, line feed, and null bytes are already rejected by Plug.Conn header validation.

Affected versions

Hex

Package	Vulnerable	Fixed in
plug	`>= 0.1.0, < 1.16.6` `>= 1.17.0, < 1.17.4` `>= 1.18.0, < 1.18.5` `>= 1.19.1, < 1.19.5` `>= 1.20.0, < 1.20.3`	`1.16.6` `1.17.4` `1.18.5` `1.19.5` `1.20.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

plug Hex → `1.20.3`

mix

{:plug, "~> 1.20.3"} # then: mix deps.update plug

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Attack vector: Local
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): Low
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): Low
Availability (subsequent systems): None

Weakness

CWE-141: Improper Neutralization of Parameter/Argument Delimiters

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

How to prevent it

Developers should anticipate that parameter/argument delimiters will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.
Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Implementation: While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).
Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

References

Advisories

github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm

Fixes and patches

Packages

hex.pm/packages/plug

Timeline

Jul 10, 2026 Published
Oct 24, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
EEF-CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments	Not rated yet	Also affects plug
EEF-CVE-2026-56814 Plug: multipart :length limit is not charged for part headers, enabling unbounded temp-file creation (denial of service)	Not rated yet	Also affects plug
EEF-CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service	High	Also affects plug
EEF-CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug	High	Also affects plug
GHSA-9h73-w7ch-rh73 Header Injection	Medium	Also affects plug
GHSA-5v4m-c73v-c7gq Arbitrary Code Execution in Cookie Serialization	High	Also affects plug
GHSA-2q6v-32mr-8p8x Null Byte Injection in Plug.Static	High	Also affects plug

Credits: Jonatan Männchen / EEF, José Valim, Peter Ullrich

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor