The httpd component of Erlang OTP has never implemented obs‑fold header continuation, meaning that a CRLF followed by a non‑CRLF octet is incorrectly parsed as the start of a new header line. This parsing flaw, classified as CWE‑444, allows an attacker to craft requests that split an initial HTTP request into two or pass a second request to a downstream server, enabling bypass of authentication, injection of malicious payloads, or unauthorized data exposure.

The vulnerability affects Erlang OTP’s inets httpd component in OTP 17.0 up to but not including OTP 27.3.4.17, OTP 28.0 up to but not including OTP 28.5.0.6, and OTP 29.0 up to but not including OTP 29.0.6, corresponding to inets releases 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. Versions prior to OTP 17.0 (inets before 5.10) have unknown status.

The flaw carries a CVSS score of 8.3, indicating high severity, and the EPSS score is not available; it is not currently listed in the CISA KEV catalog. The attack requires the ability to send HTTP requests to the target server, which is a remote action that can be performed over the public internet. Exploitation does not rely on host‑level privileges and can compromise confidentiality, integrity, or availability of the affected service if it handles sensitive data or serves as a gateway.