CVE-2026-568132.1LowCWE-141

CVE-2026-56813: Cookie attribute injection in Plug.Conn.Cookies.encode/2

elixir-plug · plug

Vendor fix available · Affected: elixir-plug plug · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.2%probability of exploitation in the next 30 days

12th percentile

050100

Higher than 12% of scored CVEs

2.1LowCVSS 4.0

LowMediumHighCrit.

DescriptionCVE.org

Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value and its path, domain, same_site, and extra attributes directly into the header without neutralizing the ; delimiter that separates cookie attributes. An application that places attacker-controlled data into a cookie value or attribute (for example via Plug.Conn.put_resp_cookie/4 when reflecting a username or preference) lets an attacker inject a ; to append or override cookie attributes (such as Domain and Path scope, or dropping the Secure and HttpOnly flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by Plug.Conn header validation, so HTTP response splitting is not possible, but attribute injection through ; is not prevented. This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3.

Affected products2

From the CVE record. A product or version that is not listed is unknown, not unaffected.

elixir-plug · plugfrom 0.1.0 before 1.16.6; from 1.17.0 before 1.17.4; from 1.18.0 before 1.18.5; from 1.19.1 before 1.19.5; from 1.20.0 before 1.20.3
elixir-plug · plugVersions not stated

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Neutralization of Parameter/Argument Delimiters · Injection and Smuggling
Vendor: elixir-plug
Published: July 2026
Band: Unlikely (under 1%), July 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-56813 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.