Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.

This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.

The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.

This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5.
Published: 2026-03-13
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In Erlang OTP’s inets httpd module, duplicate Content‑Length headers are not rejected or normalised. The server parses the request body using the earliest Content‑Length value while common reverse proxies (nginx, Apache httpd, Envoy) honour the last header, creating a desynchronization that violates RFC 9112 Section 6.3. This allows an attacker to craft a request that injects arbitrary data into the start of the following request, effectively enabling HTTP request smuggling. The flaw involves the httpd_request module (lib/inets/src/http_server/httpd_request.erl) and its parse_headers/7 routine and can lead to unauthorised request injection or data corruption (CWE‑444).

Affected Systems

The vulnerability affects Erlang OTP releases from 17.0 up to, but not including, 28.4.1, and also the specific releases 27.3.4.9 and 26.2.5.18, along with inets httpd versions from 5.10 up to, but not including, 9.6.1, and the specific versions 9.3.2.3 and 9.1.0.5. Systems running these versions are vulnerable unless mitigated.

Risk and Exploitability

The CVSS score is 7, indicating high severity, but the EPSS score of less than 1 % suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is likely a remote attacker sending a crafted HTTP request containing duplicate Content‑Length headers directly to the vulnerable httpd instance, as inferred from the description, potentially causing request smuggling and arbitrary request injection on the backend.

Generated by OpenCVE AI on August 4, 2026 at 19:08 UTC.

Remediation

Vendor Workaround

* Configure frontend proxy to reject requests with duplicate Content-Length headers. * Disable HTTP keep-alive on httpd by adding `{keep_alive, false}` to httpd configuration. Note: This impacts performance for clients making multiple requests. * Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers.

OpenCVE Recommended Actions

  • Configure your front‑end proxy to reject requests containing duplicate Content‑Length headers.
  • Disable HTTP keep‑alive in the inets httpd configuration by adding {keep_alive, false}; this mitigates the issue but may impact performance for clients that send multiple requests.
  • Deploy a Web Application Firewall configured to reject requests with multiple Content‑Length headers.

Generated by OpenCVE AI on August 4, 2026 at 19:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4590-1 erlang security update
History

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Description Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request. This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5. Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5.

Thu, 21 May 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang\/inets
CPEs cpe:2.3:a:erlang:erlang\/inets:*:*:*:*:*:*:*:*
Vendors & Products Erlang erlang\/inets
Metrics cvssV3_1

{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L'}

Mon, 06 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
References

Mon, 16 Mar 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Vendors & Products Erlang erlang/otp

Fri, 13 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 13 Mar 2026 09:30:00 +0000

Type Values Removed Values Added
Description Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request. This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.
Title Request smuggling via first-wins Content-Length parsing in inets httpd
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-444
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L'}

Subscriptions

Erlang Erlang/otp Erlang\/inets Erlang\/otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-07-24T14:15:30.978Z

Reserved: 2026-01-19T14:23:14.343Z

Link: CVE-2026-23941

cve-icon Vulnrichment

Updated: 2026-03-13T16:00:52.958Z

cve-icon NVD

Status : Modified

Published: 2026-03-13T19:54:15.237

Modified: 2026-07-24T15:17:14.157

Link: CVE-2026-23941

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T19:15:03Z

Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')