Erlang OTP inets EUVD-2026-69235

Exploitation requires a two-tier HTTP/1.1 pipeline where the front-end component (load balancer, CDN, or reverse proxy) is configured to prefer Content-Length for request body framing while the inets httpd backend prefers Transfer-Encoding (chunked). The attacker must be able to send HTTP requests carrying both Transfer-Encoding: chunked and a Content-Length value that misaligns with the chunked boundary. Exploitation is NOT possible when: (a) inets is exposed directly without any CL-preferring front-end proxy, (b) the front-end is also TE-preferring (producing a TE.TE topology rather than CL.TE), or (c) the front-end normalizes, strips, or rejects conflicting framing headers prior to forwarding. CVSS 4.0 AT:P explicitly encodes this topology dependency. Authentication is not required (PR:N per the provided CVSS 4.0 vector) and no victim user interaction is needed by the attacker to deliver the smuggled prefix.

The CVSS 4.0 score of 8.3 is well-calibrated: AT:P (Attack Requirements: Present) correctly encodes that exploitation requires a specific proxy topology - a CL-preferring front-end forwarding to an inets backend - which is not the default or universal deployment mode, meaningfully limiting real-world exposure compared to the raw VI:H impact rating implies. Deployments exposing inets directly or behind a TE-preferring proxy face no desync risk from this issue. The VI:H rating is justified because successful smuggling allows an attacker to corrupt the request pipeline, potentially prepending attacker-controlled data to another user's request, enabling session hijacking or authorization bypass. No EPSS data is present in the source intelligence, precluding probabilistic exploitation-likelihood comparison. KEV listing is absent and no POC has been identified, so active exploitation is unconfirmed. However, the CL.TE attack class is extensively documented and tool-assisted discovery is accessible to moderately skilled attackers using widely available tooling such as Burp Suite's HTTP Request Smuggler extension - the gap between 'no known public exploit' and 'viable exploitation' is narrow when the required topology is present. Overall priority should be high for any inets deployment behind a CL-preferring reverse proxy and low-to-negligible for all other configurations.

An unauthenticated attacker sends a crafted HTTP/1.1 request containing both a Transfer-Encoding: chunked header and a Content-Length header whose value misaligns with the actual chunk boundary to a CL-preferring reverse proxy sitting in front of an inets-backed application. The proxy, honoring Content-Length, considers the message complete and forwards it; inets, preferring chunked encoding, interprets the trailing attacker-controlled bytes as the beginning of a new HTTP request, prepending them to the next victim's request and potentially overwriting security-sensitive headers or parameters. No public POC has been identified, but the CL.TE technique is extensively documented and discoverable using tools such as Burp Suite's HTTP Request Smuggler extension.