This vulnerability exposes Erlang/OTP inets and httpd to HTTP Request Smuggling through the improper handling of Transfer-Encoding (TE) and Content-Length (CL) headers. The check_header function fails to detect the co‑presence of TE and CL, a scenario identified by RFC 9112 §6.3 as a smuggling vector. Consequently, a malicious request can be parsed differently by a front‑end that prefers CL and a back‑end that prefers TE, allowing the attacker to inject or manipulate the back‑end request stream. The impact of this desynchronisation includes the potential to bypass authentication controls, read or modify privileged data, and trigger arbitrary code execution at the server level, as reflected in the CWE‑444 identifier. The vulnerability is specifically problematic when a CL‑preferring front‑end is paired with a chunked‑preferring inets component, creating a classic CL.TE front‑end/back‑end desynchronisation.

The affected package is the Erlang/OTP inets module. Versions impacted include OTP releases from OTP 17.0 up to but not including OTP 27.3.4.17, OTP 28.0 up to but not including OTP 28.5.0.6, and OTP 29.0 up to but not including OTP 29.0.6. The corresponding inets library versions are 5.10 up to but not including 9.3.2.7, 9.4 up to but not including 9.6.2.3, and 9.7 up to but not including 9.7.2. The status of OTP versions prior to 17.0 (inets prior to 5.10) remains uncertain.

The CVSS score of 8.3 places this issue in the high‑severity range, indicating significant potential damage if exploited. The EPSS score is not available, so the current likelihood of exploitation is unknown from that metric, but the lack of listing in the CISA KEV catalog suggests it has not yet been widely leveraged by threat actors. The attack vector is remote, relying solely on HTTP traffic sent to an affected inets/httpd instance; no authentication or special privileges are required. An attacker can craft a malicious request containing duplicate Content‑Length headers or unsanitised TE and CL headers to achieve smuggling, leading to possible remote code execution or data exfiltration.