CVE-2026-66357

Deferred Deferred - Pending Action

HTTP Request Smuggling in Erlang OTP

Publication date: 2026-09-01

Last updated on: 2026-09-08

Assigner: EEF

Description

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-08

Generated

2026-09-21

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-20

NVD

CVE-2026-66357

EUVD

EUVD-2026-69232

Affected Vendors & Products

Vendor	Product	Version / Range
erlang	otp	From 17.0 (inc) to 27.3.4.17 (exc)
erlang	otp	From 28.0 (inc) to 28.5.0.6 (exc)
erlang	otp	From 29.0 (inc) to 29.0.6 (exc)
erlang	inets	From 5.10 (inc) to 9.3.2.7 (exc)
erlang	inets	From 9.4 (inc) to 9.6.2.3 (exc)
erlang	inets	From 9.7 (inc) to 9.7.2 (exc)
otp	otp	to 27.3.4.17 (exc)
otp	otp	to 28.5.0.6 (exc)
otp	otp	to 29.0.6 (exc)
inets	inets	to 9.3.2.7 (exc)
inets	inets	to 9.6.2.3 (exc)
inets	inets	to 9.7.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-444	The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

Executive Summary

CVE-2026-66357 is an HTTP Request Smuggling vulnerability in the Erlang/OTP inets HTTP server (httpd). The issue occurs because httpd does not properly handle obsolete line folding (obs-fold) in HTTP headers as specified in RFC 9112. Instead of rejecting such requests, it incorrectly treats continuation lines (CRLF followed by space or tab) as new headers. This creates a security risk where attackers can smuggle hidden headers, enabling request smuggling attacks when httpd is behind a reverse proxy.

Detection Guidance

To detect this vulnerability, check if your Erlang/OTP httpd server is running a vulnerable version (before 27.3.4.17, 28.5.0.6, or 29.0.6). Use commands like 'erl -version' or 'inets:info()' in an Erlang shell to verify versions. Monitor HTTP traffic for malformed headers with CRLF followed by space or tab, which may indicate obs-fold attempts.

Impact Analysis

This vulnerability allows attackers to perform HTTP request smuggling, which can lead to unauthorized access, data breaches, or bypassing security controls. If you use Erlang/OTP versions 17.0 to 27.3.4.16, 28.0 to 28.5.0.5, or 29.0 to 29.0.5 behind a reverse proxy, an attacker could smuggle requests to access sensitive data, manipulate responses, or impersonate users. The impact includes potential integrity and confidentiality violations.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (healthcare data privacy) by enabling unauthorized access to sensitive data through request smuggling. Organizations using affected Erlang/OTP versions may fail to protect personal or health data adequately, risking legal penalties, reputational damage, and loss of trust. Compliance requires patching or mitigating the issue promptly.

Mitigation Strategies

Immediately upgrade to patched versions: OTP 27.3.4.17, 28.5.0.6, or 29.0.6. If upgrading is not possible, avoid using reverse proxies or configure them to reject requests with obs-fold headers. Ensure httpd rejects such requests with a 400 Bad Request response as per RFC 9112.

Hi! I’m here to help you understand CVE-2026-66357. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70