Inconsistent interpretation of HTTP requests in Erlang OTP - CVE-2026-73812

 

Inconsistent interpretation of HTTP requests in Erlang OTP - CVE-2026-73812

Published: September 2, 2026


Vulnerability identifier: #VU146840
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73812
CWE-ID: CWE-444
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass proxy access controls, poison responses intended for other users, and bypass authentication enforced at the proxy layer.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the inets httpd server when processing requests containing both Transfer-Encoding: chunked and Content-Length headers behind a reverse proxy that prefers Content-Length. A remote attacker can send a specially crafted request to bypass proxy access controls, poison responses intended for other users, and bypass authentication enforced at the proxy layer.

Exploitation requires httpd to be deployed behind a reverse proxy that processes Content-Length preferentially over Transfer-Encoding.


Affected software

Erlang OTP

How to mitigate CVE-2026-73812

Install security update from vendor's website.

Erlang OTP - addressed in versions 17.0, 27.3.4.17, 28.5.0.6, 29.0.6

External References

Related Security Bulletins