EUVD-2026-42876Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector for HTTP-based attack; AC:H for prerequisite of reflecting user data into cookies; S:C for cross-browser cookie security impact.
Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db).
CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes.
The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ';' delimiter that separates cookie attributes.
An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ';' to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ';' is not prevented.
This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.0 before 1.19.5, from 1.20.0 before 1.20.3.
AnalysisAI
Cookie attribute injection in elixir-plug's Plug library allows a remote attacker who can supply values reflected into Set-Cookie headers to inject the ; delimiter and override attributes such as Domain, Path, Secure, and HttpOnly. Applications calling Plug.Conn.put_resp_cookie/4 with user-controlled data - for example, reflecting a username or preference value - are exposed to session fixation and cookie tossing across five supported release lines (0.1.0 through 1.20.2). No public exploit code or CISA KEV listing is present at time of analysis, but the attack is mechanically straightforward wherever the vulnerable code pattern exists.
Technical ContextAI
The vulnerability resides in Plug.Conn.Cookies.encode/2 within lib/plug/conn/cookies.ex - the core cookie-serialization function of elixir-plug, the foundational HTTP middleware used by Phoenix and other Elixir web frameworks. The root cause (CWE-141: Improper Neutralization of Parameter/Argument Delimiters) is direct string interpolation of the cookie value, path, domain, same_site, and extra attributes into the Set-Cookie response header without stripping or encoding the ; character, which RFC 6265 uses to delimit cookie attributes. Plug's existing header validation does reject CRLF and null bytes - precluding HTTP response splitting - but the ; delimiter passes through unfiltered. Affected versions span plug 0.1.0-1.16.5, 1.17.0-1.17.3, 1.18.0-1.18.4, 1.19.0-1.19.4, and 1.20.0-1.20.2.
RemediationAI
Upgrade Plug to the patched release for your active branch: 1.16.6, 1.17.4, 1.18.5, 1.19.5, or 1.20.3, referencing the upstream fix commit at https://github.com/elixir-plug/plug/commit/c6575800b2c4e15af1904df87522ca8a23da020c and the full advisory at https://github.com/elixir-plug/plug/security/advisories/GHSA-wpmj-jh88-rpgm. As an interim measure pending upgrade, audit all invocations of Plug.Conn.put_resp_cookie/4 and Plug.Conn.put_resp_cookie/3 in the codebase and strip or reject ; characters from any attacker-influenced inputs before they reach cookie parameters - note that ad-hoc sanitization risks incomplete coverage across all call sites and should not substitute for patching. Applications that set only server-generated, static cookie values are not exposed and do not require emergency remediation.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today