CVE-2026-73276
Received Received - Intake

HTTP Request Smuggling in Erlang/OTP inets

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: EEF

Description
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-01
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-73276
EUVD
EUVD-2026-69233

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
erlang otp From 22.2 (inc) to 27.3.4.17 (exc)
erlang otp From 28.0 (inc) to 28.5.0.6 (exc)
erlang otp From 29.0 (inc) to 29.0.6 (exc)
erlang inets From 7.1.2 (inc) to 9.3.2.7 (exc)
erlang inets From 9.4 (inc) to 9.6.2.3 (exc)
erlang inets From 9.7 (inc) to 9.7.2 (exc)
otp otp From 22.2 (exc) to 27.3.4.17 (exc)
otp otp From 28.0 (exc) to 28.5.0.6 (exc)
otp otp From 29.0 (exc) to 29.0.6 (exc)
inets inets From 7.1.2 (exc) to 9.3.2.7 (exc)
inets inets From 9.4 (exc) to 9.6.2.3 (exc)
inets inets From 9.7 (exc) to 9.7.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the Erlang/OTP inets HTTP server (httpd) incorrectly handling HTTP headers with whitespace before the colon, such as 'Content-Length : 6'. Instead of rejecting these malformed headers per RFC 7230, httpd silently ignored them, defaulting values like Content-Length to 0. This caused the request body to be misinterpreted as a new pipelined request, enabling HTTP Request Smuggling attacks where attackers could inject malicious requests.

Detection Guidance

To detect this vulnerability, inspect HTTP traffic for malformed headers with whitespace before colons (e.g., 'Content-Length : 6'). Use tools like Wireshark or tcpdump to capture and analyze HTTP requests. Check if your Erlang/OTP httpd server responds with 400 errors for such malformed headers.

Impact Analysis

An attacker could exploit this to smuggle malicious HTTP requests through the vulnerable server, potentially bypassing security controls, accessing unauthorized data, or launching further attacks. The impact depends on deployment; if httpd is behind a lenient reverse proxy, the attack becomes more feasible. Systems processing sensitive data or exposed to untrusted networks are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating confidentiality and integrity requirements in GDPR and HIPAA. For example, GDPR mandates protection of personal data, and HIPAA requires safeguards for protected health information. Exploitation may result in non-compliance, legal penalties, or reputational damage due to data breaches.

Mitigation Strategies

Immediately update affected Erlang/OTP versions to patched releases (27.3.4.17, 28.5.0.6, or 29.0.6) and corresponding inets versions (9.3.2.7, 9.6.2.3, or 9.7.2). If updating is not possible, configure your reverse proxy to reject malformed headers or normalize headers by stripping whitespace before forwarding requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart