Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-73812 – HTTP Request Smuggling – Erlang/OTP inets httpd

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-73812 is an HTTP request smuggling vulnerability (CWE-444: Inconsistent Interpretation of HTTP Requests) in the inets httpd HTTP server module of Erlang/OTP. The httpd server accepts requests that simultaneously contain both Transfer-Encoding: chunked and Content-Length headers without rejecting them or closing the connection, in violation of RFC 9112 §6.1. When httpd sits behind a reverse proxy that determines message boundaries differently (e.g., by prioritizing Content-Length), this framing disagreement can be abused for a CL.TE-style desync attack. The issue carries a CVSS score of 8.3 (High) and is remotely exploitable over the network without authentication.

Technical details

  • Root cause: The check_header/3 function in inets‘s httpd validates and rejects duplicate Content-Length headers (addressed in a prior CVE) but does not detect or reject the co-presence of Transfer-Encoding and Content-Length headers in the same request, a condition RFC 9112 §6.1/§6.3 flags as a probable smuggling attempt.
  • Trigger conditions: handle_body/3 frames the request body according to chunked encoding whenever Transfer-Encoding is present, silently discarding the Content-Length value rather than rejecting the malformed request or closing the connection.
  • Attack vector: Network-based, unauthenticated. Exploitation requires httpd to be deployed behind a front-end proxy/load balancer that resolves message boundaries using Content-Length (a classic CL.TE mismatch), allowing an attacker-crafted request to be interpreted differently by the front-end and back-end.
  • Impact: Attackers can smuggle a hidden second request past the front-end proxy, potentially bypassing proxy-enforced access controls or authentication, poisoning responses delivered to other users, or injecting requests attributed to other sessions. Per the CVSS vector, integrity impact is High and confidentiality impact is Low, with no direct availability impact.

Affected software

  • Erlang/OTP: OTP 17.0 up to (but not including) OTP 27.3.4.17
  • Erlang/OTP: OTP 28.0 up to (but not including) OTP 28.5.0.6
  • Erlang/OTP: OTP 29.0 up to (but not including) OTP 29.0.6
  • inets application: 5.10 up to (but not including) 9.3.2.7; 9.4 up to (but not including) 9.6.2.3; 9.7 up to (but not including) 9.7.2
  • Whether versions of OTP prior to 17.0 (inets prior to 5.10) are affected is unconfirmed by the vendor.

Severity

  • CVSS Score: 8.3 (High)
  • CVSS Vector (v4.0): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

  • Immediate: Upgrade to the patched Erlang/OTP releases: OTP 27.3.4.17, OTP 28.5.0.6, or OTP 29.0.6 (corresponding inets versions 9.3.2.7, 9.6.2.3, or 9.7.2).
  • If patching is not immediately possible:
    • Avoid placing inets httpd behind a reverse proxy that resolves request framing via Content-Length while httpd prioritizes Transfer-Encoding; if a proxy tier cannot be removed, configure it to reject any inbound request containing both Transfer-Encoding and Content-Length headers.
    • Where supported, configure front-end proxies to normalize requests by stripping Content-Length whenever Transfer-Encoding: chunked is present, before forwarding to httpd.
    • Where feasible, run httpd without a front-end reverse proxy to eliminate the desync vector entirely.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge