Inconsistent interpretation of HTTP requests in Erlang OTP - CVE-2026-73812
Published: September 2, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass proxy access controls, poison responses intended for other users, and bypass authentication enforced at the proxy layer.
The vulnerability exists due to inconsistent interpretation of HTTP requests in the inets httpd server when processing requests containing both Transfer-Encoding: chunked and Content-Length headers behind a reverse proxy that prefers Content-Length. A remote attacker can send a specially crafted request to bypass proxy access controls, poison responses intended for other users, and bypass authentication enforced at the proxy layer.
Exploitation requires httpd to be deployed behind a reverse proxy that processes Content-Length preferentially over Transfer-Encoding.