EEF-CVE-2026-56813

Cookie attribute injection in Plug.Conn.Cookies.encode/2

## Summary Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The `Plug.Conn.Cookies.encode/2` function in `lib/plug/conn/cookies.ex` builds the `Set-Cookie` response header by interpolating the cookie value and its `path`, `domain`, `same_site`, and `extra` attributes directly into the header without neutralizing the `;` delimiter that separates cookie attributes. An application that places attacker-controlled data into a cookie value or attribute (for example via `Plug.Conn.put_resp_cookie/4` when reflecting a username or preference) lets an attacker inject a `;` to append or override cookie attributes (such as `Domain` and `Path` scope, or dropping the `Secure` and `HttpOnly` flags), enabling cookie tossing and session fixation. Carriage return, line feed, and null bytes are rejected by `Plug.Conn` header validation, so HTTP response splitting is not possible, but attribute injection through `;` is not prevented. This issue affects plug: from 0.1.0 before 1.16.6, from 1.17.0 before 1.17.4, from 1.18.0 before 1.18.5, from 1.19.1 before 1.19.5, and from 1.20.0 before 1.20.3. ## Workarounds Validate or reject the `;` delimiter in any untrusted data before passing it as a cookie value or attribute to `Plug.Conn.put_resp_cookie/4` or `Plug.Conn.Cookies.encode/2`. Carriage return, line feed, and null bytes are already rejected by `Plug.Conn` header validation.