Riskcovery

CVE-2026-73276

inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

State
Published
Severity
8.3 High
Published
Sep 1, 2026
Updated
Sep 8, 2026
Reserved
Aug 12, 2026

Read the record on cve.org

Description

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.

This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Scores

CVSSScoreVectorSource
4.08.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:NEEF

Weaknesses

  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected Products

ProductVersions
OTPErlang
  • 22.2 to before 27.3.4.17Affected
  • 28.0 to before 28.5.0.6Affected
  • 29.0 to before 29.0.6Affected
OTPErlang
  • 7.1.2 to before 9.3.2.7Affected
  • 9.4 to before 9.6.2.3Affected
  • 9.7 to before 9.7.2Affected
OTPErlang
  • c06db0bedf49a9b40725745e73fa82e562612815 and laterAffectedfrom 60add5a19e2154560fdff3fe92dba14a68bbd683Not affectedfrom 6cd995e34d3bb3d36dd278dded2d62c25e71820cNot affectedfrom c285240c6e4b93960c5dc4f17ba04e6fdfb27a0fNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.