CVE-2026-66357
Received Received - Intake

HTTP Request Smuggling in Erlang OTP

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-66357
EUVD
EUVD-2026-69232

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
otp otp to 27.3.4.17 (exc)
otp otp to 28.5.0.6 (exc)
otp otp to 29.0.6 (exc)
inets inets to 9.3.2.7 (exc)
inets inets to 9.6.2.3 (exc)
inets inets to 9.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-66357 is an HTTP Request Smuggling vulnerability in the Erlang/OTP inets HTTP server (httpd). The issue occurs because httpd does not properly handle obsolete line folding (obs-fold) in HTTP headers as specified in RFC 9112. Instead of rejecting such requests, it incorrectly treats continuation lines (CRLF followed by space or tab) as new headers. This creates a security risk where attackers can smuggle hidden headers, enabling request smuggling attacks when httpd is behind a reverse proxy.

Detection Guidance

To detect this vulnerability, check if your Erlang/OTP httpd server is running a vulnerable version (before 27.3.4.17, 28.5.0.6, or 29.0.6). Use commands like 'erl -version' or 'inets:info()' in an Erlang shell to verify versions. Monitor HTTP traffic for malformed headers with CRLF followed by space or tab, which may indicate obs-fold attempts.

Impact Analysis

This vulnerability allows attackers to perform HTTP request smuggling, which can lead to unauthorized access, data breaches, or bypassing security controls. If you use Erlang/OTP versions 17.0 to 27.3.4.16, 28.0 to 28.5.0.5, or 29.0 to 29.0.5 behind a reverse proxy, an attacker could smuggle requests to access sensitive data, manipulate responses, or impersonate users. The impact includes potential integrity and confidentiality violations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized access to sensitive data through request smuggling. Organizations using affected Erlang/OTP versions may fail to protect personal or health data adequately, risking legal penalties, reputational damage, and loss of trust. Compliance requires patching or mitigating the issue promptly.

Mitigation Strategies

Immediately upgrade to patched versions: OTP 27.3.4.17, 28.5.0.6, or 29.0.6. If upgrading is not possible, avoid using reverse proxies or configure them to reject requests with obs-fold headers. Ensure httpd rejects such requests with a 400 Bad Request response as per RFC 9112.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66357. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart