CVE-2026-73270
Received Received - Intake

Case Sensitivity Bypass in Erlang/OTP inets httpd

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. mod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased path to the same file and mod_get serves it. Deployments on case-sensitive filesystems are unaffected, because there the filesystem itself rejects the mismatched casing. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-73270
EUVD
EUVD-2026-69243

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
erlang otp From 17.0 (inc) to 27.3.4.17 (exc)
erlang otp From 28.0 (inc) to 28.5.0.6 (exc)
erlang otp From 29.0 (inc) to 29.0.6 (exc)
erlang inets From 5.10 (inc) to 9.3.2.7 (exc)
erlang inets From 9.4 (inc) to 9.6.2.3 (exc)
erlang inets From 9.7 (inc) to 9.7.2 (exc)
erlang otp to 27.3.4.17 (exc)
erlang otp to 28.5.0.6 (exc)
erlang otp to 29.0.6 (exc)
erlang inets to 9.3.2.7 (exc)
erlang inets to 9.6.2.3 (exc)
erlang inets to 9.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in Erlang/OTP's inets httpd server, specifically in the mod_auth module. It occurs because mod_auth checks directory paths with case-sensitive matching, but on case-insensitive filesystems like Windows or macOS, attackers can request files with different casing to bypass authentication. For example, requesting /secret/file against a protected /Secret directory fails to trigger authentication, yet the filesystem resolves the path to the same file.

Detection Guidance

Check if your Erlang/OTP inets httpd server is running on a case-insensitive filesystem (Windows/macOS). Inspect the mod_auth configuration for protected directories. Test by requesting files with different casing in the path, e.g., curl http://server/Secret/file.txt vs curl http://server/secret/file.txt. If the latter bypasses authentication, the system is vulnerable.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to bypass authentication and access protected files on systems using case-insensitive filesystems. It requires httpd to be deployed with at least one directory block configured with mod_auth. Attackers can exploit this by requesting files with different casing, such as /secret/file instead of /Secret/file, to access sensitive data without credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Unauthorized access to protected files may result in data breaches, leading to legal penalties, reputational damage, and loss of trust. Organizations must address this issue to maintain compliance with these regulations.

Mitigation Strategies

Upgrade Erlang/OTP to patched versions (OTP 27.3.4.17+, 28.5.0.6+, 29.0.6+) or inets to 9.3.2.7+, 9.6.2.3+, 9.7.2+. Alternatively, host the document root on a case-sensitive filesystem, use a reverse proxy to normalize paths, or restrict server access to trusted clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart