Inconsistent interpretation of HTTP requests in Erlang OTP - CVE-2026-73276
Published: September 2, 2026
Vulnerability identifier: #VU146838
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73276
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to smuggle HTTP requests.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the inets httpd server when processing malformed HTTP headers with whitespace before the colon behind a lenient reverse proxy. A remote attacker can send a specially crafted request to smuggle HTTP requests.
Exploitation requires the server to be deployed behind a reverse proxy that accepts headers containing whitespace before the colon and forwards the request body.
Affected software
Erlang OTP
How to mitigate CVE-2026-73276
Install security update from vendor's website.
Erlang OTP - addressed in versions 17.0, 27.3.4.17, 28.5.0.6, 29.0.6