The vulnerability arises from improper neutralization of parameter delimiters (CWE-141) in the plug library for Elixir. Specifically, the Plug.Conn.Cookies.encode/2 function builds the Set-Cookie HTTP response header by directly inserting cookie values and attributes without sanitizing the ';' delimiter. This allows an attacker who can control cookie values or attributes (e.g., via Plug.Conn.put_resp_cookie/4) to inject additional cookie attributes or override existing ones, such as Domain, Path, Secure, or HttpOnly flags. Although carriage return, line feed, and null bytes are rejected, preventing HTTP response splitting, the injection of ';' is not prevented, enabling attribute injection attacks like cookie tossing and session fixation. Affected versions include all from 0.1.0 up to but not including 1.16.6, and from 1.17.0 up to but not including 1.17.4, 1.18.5, 1.19.5, and 1.20.3 respectively.

An attacker able to inject or override HTTP cookie attributes can manipulate cookie scope and security settings, potentially enabling cookie tossing and session fixation attacks. This can undermine session integrity and security controls relying on cookie attributes. However, the vulnerability does not allow HTTP response splitting due to header validation rejecting CR, LF, and null bytes. The overall impact is limited by the requirement for attacker-controlled input in cookie values or attributes and the low CVSS score reflects this.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid placing untrusted or attacker-controlled data directly into cookie values or attributes. Validate and sanitize any input used in cookies to prevent injection of the ';' delimiter. Monitor vendor communications for patches or updates addressing this issue.