EUVD-2026-69233Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Request smuggling requires a proxy front-end with divergent header parsing (AC:H); scope changes (S:C) as the attack crosses request boundaries to affect other users' sessions.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
3DescriptionCVE.org
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
AnalysisAI
Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29.0 to conduct HTTP Request Smuggling by sending headers with whitespace before the colon - a malformed construct the server silently discarded rather than rejecting as mandated by RFC 7230 Section 3.2.4. When inets is deployed behind a front-end proxy or load balancer that interprets such headers differently, the resulting parsing discordance creates a desynchronized request boundary exploitable for session hijacking, authentication bypass, or cache poisoning. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous conditions: the target must run a vulnerable Erlang/OTP inets HTTP server (OTP 22.2 through 29.0 before patched versions), AND the inets server must be deployed behind a front-end proxy or load balancer whose HTTP header parsing behavior differs from inets' behavior of silently discarding headers with whitespace before the colon. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N) scores 8.3, reflecting network-accessible, unauthenticated exploitation with high integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Erlang/OTP to the patched release for your branch: OTP 27.3.4.17 or later (inets 9.3.2.7) for the OTP 27.x line, OTP 28.5.0.6 or later (inets 9.6.2.3) for the OTP 28.x line, or OTP 29.0.6 or later (inets 9.7.2) for the OTP 29.x line. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Erlang/OTP versions 22.2 through 29.0 in production, particularly those behind proxies or load balancers, and prepare patched versions in staging environments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation
An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th
Denial of service in Erlang/OTP erts (inet_drv SCTP handler) lets unauthenticated remote attackers crash the BEAM VM by
Unauthenticated denial of service in Erlang/OTP's inets httpd allows any remote attacker to exhaust a server's process p
Remote denial of service in Erlang/OTP's ssl application (dtls_packet_demux module) lets an unauthenticated attacker cra
Erlang/OTP's inets HTTP server (httpd) is vulnerable to a slow-body resource exhaustion attack exploitable by unauthenti
Uncontrolled recursion in the Erlang/OTP ssl application when processing a crafted TLS/DTLS certificate chain allows rem
Erlang/OTP's inets HTTP server (httpd) fails to enforce an administrator-configured request body-size limit when process
We need to output a JSON object based on the CVE-2026-59250 data. We must synthesize from multiple sources: description,
HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arb
Request smuggling in Erlang OTP inets (versions 17.0 through 29.x) arises when the httpd server sits behind a Content-Le
Unauthenticated file disclosure in Erlang/OTP's inets httpd allows remote attackers on case-insensitive filesystem deplo
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today