Improper neutralization of the ';' delimiter in the Plug overrides cookie attributes such as Secure, HttpOnly, Domain, and Path. This is a CWE‑141 flaw that lets a malicious actor alter or prepend additional attributes in a Set‑Cookie header sent by the application. By controlling data placed in a cookie value or attribute, an attacker can cause the server to issue a tossing or session fixation scenario.

The vulnerability affects the elixir‑plug plug library across all versions prior to 1.16.6, 1.17.4, 1.18.5, 1.19.5, and 1.20.3. Applications built with Plug that pass untrusted data into Plug.Conn.put_resp_cookie/4 or Plug.Conn.Cookies.encode/2 will be impacted.

The CVSS score of 2.1 classifies this issue as low severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to influence cookie values or attributes that the application sends back to the client, and existing header validation blocks response splitting. While no public exploits have been reported, the risk remains theoretical, but mitigation is recommended due to the potential impact on session integrity.