Skip to main content

Erlang EUVDEUVD-2026-11776

| CVE-2026-23941 HIGH
HTTP Request/Response Smuggling (CWE-444)
2026-03-13 EEF
Apache Information Disclosure Nginx Request Smuggling Otp Erlang
7.0
CVSS 4.0 · Vendor: EEF
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft HTTP request with duplicate Content-Length headers
  2. Delivery
    Erlang OTP httpd parses earliest value
  3. Exploit
    Reverse proxy interprets last value
  4. Execution
    Request smuggling desynchronizes interpretations
  5. Impact
    Inject malicious payload in second request

Vulnerability Assessment

Weakness
CWE
CWE-444
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
Exploitation Conditions

Erlang OTP inets httpd module deployed behind reverse proxy (nginx, Apache httpd, or Envoy). Requires HTTP requests with duplicate Content-Length headers reaching both frontend proxy and backend httpd server with differing Content-Length value interpretations.
Impact

The CVSS 4.0 score of 7.0 reflects a network-accessible vulnerability (AV:N) with high attack complexity (AC:H) requiring present attack requirements (AT:P) and no privileges (PR:N). The most concerning aspect is the high impact on subsequent system confidentiality (SC:H) and integrity (SI:H), indicating successful exploitation can compromise other users' data. The vulnerability is not listed in CISA KEV and lacks EPSS data, suggesting no known active exploitation in the wild. No public proof-of-concept code appears to be available based on the provided references. The high attack complexity and requirement for specific proxy/backend configurations reduce the likelihood of opportunistic attacks, but targeted attacks against known Erlang-based services remain a concern. Organizations should prioritize this based on their exposure of Erlang HTTP services behind reverse proxies rather than treating it as a critical emergency.
Exploit ScenarioDerived

An attacker sends a specially crafted HTTP request through a reverse proxy (like nginx) to an Erlang OTP backend, including duplicate Content-Length headers with different values. The proxy uses the last Content-Length value (e.g., 50 bytes) while the Erlang server uses the first value (e.g., 10 bytes), causing the backend to interpret the remaining 40 bytes as the start of a new request. This allows the attacker to inject arbitrary HTTP requests that appear to originate from other users, potentially accessing their authenticated sessions or poisoning shared caches with malicious content.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 13, 2026

A critical HTTP Request Smuggling vulnerability exists in Erlang OTP's inets httpd module that allows attackers to desynchronize front-end and back-end servers by exploiting inconsistent Content-Length header parsing. The vulnerability affects Erlang OTP versions from 17.0 through 28.4.0 (inets 5.10 through 9.6.0) and enables attackers to bypass security controls, potentially poisoning web caches or accessing unauthorized resources. While not currently listed in CISA KEV or showing high EPSS scores, the vulnerability has a CVSS 4.0 score of 7.0 and could lead to significant security boundary violations in production environments using affected Erlang-based web services.

RemediationAI

Upgrade Erlang OTP to version 28.4.1, 27.3.4.9, or 26.2.5.18 depending on your current major version branch, which include the patched inets versions 9.6.1, 9.3.2.3, or 9.1.0.5 respectively. For systems that cannot be immediately patched, configure reverse proxies to strictly validate and normalize Content-Length headers before forwarding requests to Erlang backends, rejecting any requests with duplicate Content-Length headers. Additionally, implement request size limits and timeout controls at the proxy layer to minimize the impact of potential smuggling attempts. Monitor for unusual request patterns or unexpected request boundaries in application logs as potential indicators of exploitation attempts.

Affected VersionsENISA

otp pkg:otp/inets@5.10 <pkg:otp/inets@*
otp 5.10 <*
otp 0 <*
otp 17.0 <*

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in the Erlang OTP inets httpd module, specifically in the httpd_request:parse_headers/7 function within lib/inets/src/http_server/httpd_request.erl. This is a classic CWE-444 (Inconsistent Interpretation of HTTP Requests) vulnerability where the Erlang HTTP server processes the first Content-Length header value while common reverse proxies like nginx, Apache httpd, and Envoy use the last value. This parsing discrepancy violates RFC 9112 Section 6.3, which mandates that duplicate Content-Length headers should result in request rejection. When an attacker sends a request with multiple Content-Length headers through a reverse proxy to an Erlang backend, the proxy and backend disagree on where the request body ends, leaving attacker-controlled bytes in the TCP stream that get interpreted as the beginning of the next request.

Know when Erlang gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (EEF) PRIMARY 7.0 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
SUSE 4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (EEF).

CVSS VectorVendor: EEF

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
High
Subsequent system: Integrity
High
Subsequent system: Availability
Low

Lifecycle Timeline

2
Patch released
Apr 06, 2026 - 17:17 nvd
Patch available
CVE Published
Mar 13, 2026 - 09:11 nvd
HIGH 7.0

DescriptionCVE.org

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.

This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.

The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.

This issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.

Executive ViewAI

Why It Matters

This HTTP Request Smuggling vulnerability in Erlang OTP's web server module could allow attackers to bypass security controls and inject malicious requests that appear legitimate to front-end systems but are interpreted differently by back-end services. Organizations running Erlang-based applications are at risk of unauthorized access, data theft, or system compromise if unpatched.

Business Impact: High
Compensating Controls

Apply vendor patch. If patching cannot be immediately completed, implement WAF rules to reject requests with duplicate Content-Length headers, restrict direct access to affected Erlang httpd servers behind a reverse proxy that normalizes HTTP headers, and disable the inets httpd module if not actively required for business operations.

Threat Intelligence Overview

EPSS Score
0.0%
Top 97% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +35
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

HTTP Request Smuggling HIGH

HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Erlang OTP SSH Transport Flaws

View all 3
CVE-2026-23943 MEDIUM
6.9
CVE-2026-23942 MEDIUM
5.3

More in Erlang

View all
CVE-2025-32433 CRITICAL POC
10.0 Apr 16

Erlang/OTP SSH server allows unauthenticated remote code execution by exploiting a flaw in SSH protocol message handling
CVE-2017-1000385 MEDIUM POC
5.9 Dec 12

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. Rat
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2020-13802 CRITICAL POC
9.8 Sep 02

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specificat
CVE-2014-1693 HIGH POC
7.5 Dec 08

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inje
CVE-2021-29221 HIGH POC
7.0 Apr 09

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. Rated high severity (CV
CVE-2016-10253 CRITICAL
9.8 Mar 18

An issue was discovered in Erlang/OTP 18.x. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
CVE-2022-37026 CRITICAL
9.8 Sep 21

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in
CVE-2026-89422 CRITICAL
9.3 Sep 22

Erlang/OTP's ssl application in affected releases (OTP 22.2 through the fixed 27.3.4.18, 28.5.0.7 and 29.1.1) will compl
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-55953 CRITICAL
9.1 Jul 27

An on-path attacker can force an Erlang/OTP TLS 1.2 or DTLS client to accept an anonymous cipher suite not offered by th

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-88773 CRITICAL POC
9.3
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2021-23336 MEDIUM POC
5.9
CVE-2025-55315 CRITICAL POC
9.9
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18 ADVISORY https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b ADVISORY https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6 ADVISORY https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7 ADVISORY https://ubuntu.com/security/notices/USN-8827-1 ADVISORY https://vuldb.com/?id.350825 ADVISORY https://www.erlang.org/doc/system/versions.html#order-of-versions REF https://cna.erlef.org/cves/CVE-2026-23941.html REF https://osv.dev/vulnerability/EEF-CVE-2026-23941

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy