EUVD-2026-69232Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because smuggling requires a misconfigured reverse proxy in the path; S:C because other users' requests are affected beyond the vulnerable component.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
4DescriptionCVE.org
httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
AnalysisAI
HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arbitrary HTTP headers and poison request pipelines in deployments fronted by a reverse proxy. The root cause is a longstanding absence of obs-fold support: any CRLF followed by a whitespace octet (SP or TAB) is silently parsed as a new header rather than a header continuation, causing proxy-backend disagreement on request boundaries. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the target must be running Erlang/OTP's inets httpd specifically - not Cowboy, Plug/Bandit, or other Erlang HTTP servers - on an affected OTP version (17.0 through 27.3.4.16 / 28.0 through 28.5.0.5 / 29.0 through 29.0.5); and (2) a reverse proxy, load balancer, or CDN must sit in front of httpd that does not itself reject obs-fold sequences before forwarding. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:L/SA:N) is consistent with real-world HTTP smuggling risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Erlang/OTP 27.3.4.17, 28.5.0.6, or 29.0.6 (corresponding to inets 9.3.2.7, 9.6.2.3, or 9.7.2 respectively) as identified in the GitHub security advisory at https://github.com/erlang/otp/security/advisories/GHSA-qh2f-33hj-37qf. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Erlang/OTP deployments (check versions 17.0 through 27.3.4.16, 28.5.0.5, and 29.0.5) and determine which are exposed to untrusted networks behind reverse proxies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by
Unauthenticated denial of service in Erlang/OTP's inets httpd allows any remote attacker to exhaust a server's process p
Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
Erlang/OTP's inets HTTP server (httpd) is vulnerable to a slow-body resource exhaustion attack exploitable by unauthenti
Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when process
We need to output a JSON object based on the CVE-2026-59250 data. We must synthesize from multiple sources: description,
Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29
Request smuggling in Erlang OTP inets (versions 17.0 through 29.x) arises when the httpd server sits behind a Content-Le
Unauthenticated file disclosure in Erlang/OTP's inets httpd allows remote attackers on case-insensitive filesystem deplo
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today