Gracefulness code in Erlang/OTP’s inets module ignored header cases that should have been rejected, allowing whitespace before a colon in HTTP headers to be dropped. This flaw creates a scenario where attackers can construct malformed requests that the server interprets as two distinct messages, enabling HTTP Request Smuggling. A smuggled request can bypass input validation, manipulate routing, or exhaust system resources, leading to denial of service.

Affected systems are deployments of the Erlang/OTP platform and its inets library. Vulnerable OTP releases include 22.2 up to (but not including) 27.3.4.17, 28.0 up to (but not including) 28.5.0.6, and 29.0 up to (but not including) 29.0.6. Corresponding inets releases span 7.1.2 up to 9.3.2.7, 9.4 up to 9.6.2.3, and 9.7 up to 9.7.2. Systems running these versions as web servers or proxy gateways are at risk.

The CVSS score of 8.3 signals a high severity, indicating that remote attackers could cause significant impact through HTTP Request Smuggling. An EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, making it unclear how frequently it is currently exploited. The likely attack vector is an internet‑facing server that accepts HTTP requests, requiring an attacker to deliver a specially crafted request containing whitespace before a colon in a header. If successful, the attacker could smuggle a hidden request, bypassing validation, manipulating routing, or exhausting resources to cause denial of service.