CVE-2026-73276

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-01

Last updated on: 2026-09-08

Assigner: EEF

Description

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-08

Generated

2026-11-08

AI Q&A

2026-09-01

EPSS Evaluated

2026-11-07

NVD

CVE-2026-73276

EUVD

EUVD-2026-69233

Affected Vendors & Products

Vendor	Product	Version / Range
Erlang	OTP	22.2
Erlang	OTP	28.0
Erlang	OTP	29.0
Erlang	OTP	7.1.2
Erlang	OTP	9.4
Erlang	OTP	9.7
Erlang	OTP	c06db0bedf49a9b40725745e73fa82e562612815

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Erlang/OTP inets HTTP server (httpd) incorrectly handling HTTP headers with whitespace before the colon, such as 'Content-Length : 6'. Instead of rejecting these malformed headers per RFC 7230, httpd silently ignored them, defaulting values like Content-Length to 0. This caused the request body to be misinterpreted as a new pipelined request, enabling HTTP Request Smuggling attacks where attackers could inject malicious requests.

Detection Guidance

To detect this vulnerability, inspect HTTP traffic for malformed headers with whitespace before colons (e.g., 'Content-Length : 6'). Use tools like Wireshark or tcpdump to capture and analyze HTTP requests. Check if your Erlang/OTP httpd server responds with 400 errors for such malformed headers.

Impact Analysis

An attacker could exploit this to smuggle malicious HTTP requests through the vulnerable server, potentially bypassing security controls, accessing unauthorized data, or launching further attacks. The impact depends on deployment; if httpd is behind a lenient reverse proxy, the attack becomes more feasible. Systems processing sensitive data or exposed to untrusted networks are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. For example, GDPR mandates protection of personal data, and HIPAA requires safeguards for protected health information. Exploitation may result in non-compliance, legal penalties, or reputational damage due to data breaches.

Mitigation Strategies

Immediately update affected Erlang/OTP versions to patched releases (27.3.4.17, 28.5.0.6, or 29.0.6) and corresponding inets versions (9.3.2.7, 9.6.2.3, or 9.7.2). If updating is not possible, configure your reverse proxy to reject malformed headers or normalize headers by stripping whitespace before forwarding requests.

Hi! I’m here to help you understand CVE-2026-73276. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...