Inconsistent interpretation of HTTP requests in Erlang OTP - CVE-2026-73276

Vulnerability identifier: #VU146838

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-73276

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to smuggle HTTP requests.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the inets httpd server when processing malformed HTTP headers with whitespace before the colon behind a lenient reverse proxy. A remote attacker can send a specially crafted request to smuggle HTTP requests.

Exploitation requires the server to be deployed behind a reverse proxy that accepts headers containing whitespace before the colon and forwards the request body.

Erlang OTP
PowerVC
Ubuntu
openEuler
erlang-asn1
erlang-ssl
erlang-stdlib
erlang-syntax_tools
erlang-tftp
erlang-tools
erlang-wx
erlang-xmerl
erlang
erlang-ssh
erlang-common_test
erlang-compiler
erlang-crypto
erlang-debugger
erlang-debuginfo
erlang-debugsource
erlang-dialyzer
erlang-os_mon
erlang-ftp
erlang-inets
erlang-jinterface
erlang-kernel
erlang-megaco
erlang-mnesia
erlang-observer
erlang-odbc
erlang-diameter
erlang-parsetools
erlang-public_key
erlang-reltool
erlang-runtime_tools
erlang-sasl
erlang-snmp
erlang-src
erlang-examples
erlang-eunit
erlang-et
erlang-erts
erlang-erl_interface
erlang-erl_docgen
erlang-eldap
erlang-edoc
erlang (Ubuntu package)

Install security update from vendor's website.

Erlang OTP - addressed in versions 27.3.4.17, 28.5.0.6, 29.0.6
erlang-asn1 - update to 25.3.2.6-20
erlang-ssl - update to 25.3.2.6-20
erlang-stdlib - update to 25.3.2.6-20
erlang-syntax_tools - update to 25.3.2.6-20
erlang-tftp - update to 25.3.2.6-20
erlang-tools - update to 25.3.2.6-20
erlang-wx - update to 25.3.2.6-20
erlang-xmerl - update to 25.3.2.6-20
erlang - update to 25.3.2.6-20
erlang-ssh - update to 25.3.2.6-20
erlang-common_test - update to 25.3.2.6-20
erlang-compiler - update to 25.3.2.6-20
erlang-crypto - update to 25.3.2.6-20
erlang-debugger - update to 25.3.2.6-20
erlang-debuginfo - update to 25.3.2.6-20
erlang-debugsource - update to 25.3.2.6-20
erlang-dialyzer - update to 25.3.2.6-20
erlang-os_mon - update to 25.3.2.6-20
erlang-ftp - update to 25.3.2.6-20
erlang-inets - update to 25.3.2.6-20
erlang-jinterface - update to 25.3.2.6-20
erlang-kernel - update to 25.3.2.6-20
erlang-megaco - update to 25.3.2.6-20
erlang-mnesia - update to 25.3.2.6-20
erlang-observer - update to 25.3.2.6-20
erlang-odbc - update to 25.3.2.6-20
erlang-diameter - update to 25.3.2.6-20
erlang-parsetools - update to 25.3.2.6-20
erlang-public_key - update to 25.3.2.6-20
erlang-reltool - update to 25.3.2.6-20
erlang-runtime_tools - update to 25.3.2.6-20
erlang-sasl - update to 25.3.2.6-20
erlang-snmp - update to 25.3.2.6-20
erlang-src - update to 25.3.2.6-20
erlang-examples - update to 25.3.2.6-20
erlang-eunit - update to 25.3.2.6-20
erlang-et - update to 25.3.2.6-20
erlang-erts - update to 25.3.2.6-20
erlang-erl_interface - update to 25.3.2.6-20
erlang-erl_docgen - update to 25.3.2.6-20
erlang-eldap - update to 25.3.2.6-20
erlang-edoc - update to 25.3.2.6-20
erlang (Ubuntu package) - addressed in versions 1:16.b.3-dfsg-1ubuntu2.2+esm2, 1:18.3-dfsg-1ubuntu3.1+esm3, 1:20.2.2+dfsg-1ubuntu2+esm3, 1:22.2.7+dfsg-1ubuntu0.5+esm2, 1:24.2.1+dfsg-1ubuntu0.7, 1:25.3.2.8+dfsg-1ubuntu4.7, 1:27.3.4.6+dfsg-1ubuntu0.1

• https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p

• Multiple vulnerabilities in Erlang OTP
• Ubuntu update for erlang
• openEuler 24.03 LTS SP4 update for erlang
• openEuler 24.03 LTS SP3 update for erlang
• openEuler 24.03 LTS SP1 update for erlang
• Multiple vulnerabilities in IBM PowerVC