Skip to main content

Otp CVE-2026-23941

| EUVDEUVD-2026-11776 HIGH
HTTP Request/Response Smuggling (CWE-444)
2026-03-13 EEF
Apache Information Disclosure Nginx Request Smuggling Otp Erlang
7.0
CVSS 4.0 · Vendor: EEF
Share

Severity by source

Vendor (EEF) PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch released
Apr 06, 2026 - 17:17 nvd
Patch available
EUVD ID Assigned
Mar 13, 2026 - 09:29 euvd
EUVD-2026-11776
Analysis Generated
Mar 13, 2026 - 09:29 vuln.today
CVE Published
Mar 13, 2026 - 09:11 nvd
HIGH 7.0

DescriptionCVE.org

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.

This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.

The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.

AnalysisAI

A critical HTTP Request Smuggling vulnerability exists in Erlang OTP's inets httpd module that allows attackers to desynchronize front-end and back-end servers by exploiting inconsistent Content-Length header parsing. The vulnerability affects Erlang OTP versions from 17.0 through 28.4.0 (inets 5.10 through 9.6.0) and enables attackers to bypass security controls, potentially poisoning web caches or accessing unauthorized resources. While not currently listed in CISA KEV or showing high EPSS scores, the vulnerability has a CVSS 4.0 score of 7.0 and could lead to significant security boundary violations in production environments using affected Erlang-based web services.

Technical ContextAI

The vulnerability resides in the Erlang OTP inets httpd module, specifically in the httpd_request:parse_headers/7 function within lib/inets/src/http_server/httpd_request.erl. This is a classic CWE-444 (Inconsistent Interpretation of HTTP Requests) vulnerability where the Erlang HTTP server processes the first Content-Length header value while common reverse proxies like nginx, Apache httpd, and Envoy use the last value. This parsing discrepancy violates RFC 9112 Section 6.3, which mandates that duplicate Content-Length headers should result in request rejection. When an attacker sends a request with multiple Content-Length headers through a reverse proxy to an Erlang backend, the proxy and backend disagree on where the request body ends, leaving attacker-controlled bytes in the TCP stream that get interpreted as the beginning of the next request.

RemediationAI

Upgrade Erlang OTP to version 28.4.1, 27.3.4.9, or 26.2.5.18 depending on your current major version branch, which include the patched inets versions 9.6.1, 9.3.2.3, or 9.1.0.5 respectively. For systems that cannot be immediately patched, configure reverse proxies to strictly validate and normalize Content-Length headers before forwarding requests to Erlang backends, rejecting any requests with duplicate Content-Length headers. Additionally, implement request size limits and timeout controls at the proxy layer to minimize the impact of potential smuggling attempts. Monitor for unusual request patterns or unexpected request boundaries in application logs as potential indicators of exploitation attempts.

More in Otp

View all
CVE-2022-24584 MEDIUM POC
6.5 May 11

Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
CVE-2026-49759 HIGH
8.8 Jun 10

Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by

CVE-2026-70399 HIGH
8.7 Sep 01

Unauthenticated denial of service in Erlang/OTP's inets httpd allows any remote attacker to exhaust a server's process p
CVE-2026-55950 HIGH
8.7 Jul 02

Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
CVE-2026-71380 HIGH
8.7 Sep 01

Erlang/OTP's inets HTTP server (httpd) is vulnerable to a slow-body resource exhaustion attack exploitable by unauthenti
CVE-2026-58227 HIGH
8.7 Jul 27

Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
CVE-2026-74835 HIGH
8.7 Sep 01

Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when process
CVE-2026-59250 HIGH
8.3 Jul 27

We need to output a JSON object based on the CVE-2026-59250 data. We must synthesize from multiple sources: description,
CVE-2026-73276 HIGH
8.3 Sep 01

Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29
CVE-2026-66357 HIGH
8.3 Sep 01

HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arb
CVE-2026-73812 HIGH
8.3 Sep 01

Request smuggling in Erlang OTP inets (versions 17.0 through 29.x) arises when the httpd server sits behind a Content-Le

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

CVE-2026-23941 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy