Erlang/OTP inets httpd CVE-2026-66357

Exploitation requires two concurrent conditions: (1) the target must be running Erlang/OTP's inets httpd specifically - not Cowboy, Plug/Bandit, or other Erlang HTTP servers - on an affected OTP version (17.0 through 27.3.4.16 / 28.0 through 28.5.0.5 / 29.0 through 29.0.5); and (2) a reverse proxy, load balancer, or CDN must sit in front of httpd that does not itself reject obs-fold sequences before forwarding. If httpd is directly internet-exposed without a proxy, the smuggling vector does not apply (though header injection into the httpd parsing layer may still be possible). No authentication is required (PR:N in CVSS). No user interaction is required. Exploitation is limited by the relative infrequency of inets httpd in production-facing deployments, as most Erlang web applications use Cowboy or similar servers rather than the built-in inets httpd.

The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:L/SA:N) is consistent with real-world HTTP smuggling risk. AT:P (attack requirements present) is the key constraint: exploitation requires a reverse proxy in front of httpd that does not itself reject obs-fold. EPSS data is not provided in the input, and there is no CISA KEV listing, meaning active exploitation at scale is not confirmed. POC availability is unknown. The VI:H rating reflects that successful smuggling can inject arbitrary headers into other users' requests - a high-integrity impact. The CVSS 4.0 SI:L for subsequent systems appears conservative; in typical smuggling attacks the downstream impact on other users' sessions can be substantially higher. Despite no confirmed exploitation, the attack is unauthenticated, requires no user interaction, and the affected version range spans OTP 17.0 onward - a very long exposure window. Priority should be elevated for any Erlang httpd deployment behind a load balancer or reverse proxy (nginx, HAProxy, AWS ALB) that does not already strip or reject obs-fold sequences.

An attacker sends a crafted HTTP/1.1 request to a reverse proxy with an obs-fold line - for example, a line starting with a space after a CRLF - embedding a Transfer-Encoding: chunked header as a folded continuation. The proxy interprets it as a single header field (correct RFC behavior) and forwards a normalized representation, while the unfixed Erlang httpd treats the folded line as a new, separate header, creating a discrepancy in request boundary parsing. This allows the attacker to prepend data to the next request processed by httpd on that connection, potentially hijacking another user's session or injecting arbitrary content into their response. No public POC has been identified at time of analysis.