CVE-2026-56813: plug 0.1.0 to before 1.16.6, 1.17.0 to before 1.17.4, 1.18.0 to before 1.18.5, 1.19.1 to before 1.19.5, 1.20.0 to…

Affected technology

plug · 0.1.0 to before 1.16.6, 1.17.0 to before 1.17.4, 1.18.0 to before 1.18.5, 1.19.1 to before 1.19.5, 1.20.0 to before 1.20.3
elixir-plug

plug · f26876aa67aaeb38e616638aa3efbcc2fe2906a5 to before *; status changes: 3f00dfad4e20ba88472e315c90a25742bf178f8e — unaffected, a6d1248659022749869963fd302687165ecf8c8b — unaffected, 4167981747fe9ce75f374b94a28861ae950ea992 — unaffected, 149d9ed68fee0b4f77efd1e835ce5d785856697b — unaffected, eceb8315ce9a31ef784943a95a8624ebd1bc7e06 — unaffected
elixir-plug

Component: 'Elixir.Plug.Conn.Cookies', 'Elixir.Plug.Conn'
Function: 'Elixir.Plug.Conn.Cookies':encode/2, 'Elixir.Plug.Conn':put_resp_cookie/4, in
File: lib/plug/conn/cookies.ex

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

An attacker can inject or override HTTP cookie attributes. Source advisory’s CVSS 4.0 assessment (base score 2.1/10) rates confidentiality and availability impact as none; integrity impact as low.