CVE-2026-66357

The HTTP server (httpd) in Erlang/OTP's inets application has never implemented obs-fold (header continuation lines), so every CRLF followed by any non-CRLF octet is unconditionally parsed as the start of a new header rather than a folded continuation. An attacker sends HTTP requests containing folded header lines that a front-end proxy treats as continuations while httpd treats them as separate headers, causing the proxy and backend to disagree about message boundaries and enabling classic HTTP request smuggling (CWE-444). Successful smuggling can let the attacker bypass access controls, poison or hijack responses, or corrupt downstream requests; CVSS 4.0 rates this 8.3 (high) with high integrity impact on the vulnerable system. All deployments using inets httpd in the affected OTP release lines are exposed, particularly those placed behind reverse proxies or load balancers that accept obs-fold; whether OTP releases before 17.0 (inets before 5.10) are affected is unknown. No public PoC exists, it is not in CISA KEV, and EPSS is low (0.3% probability of exploitation within 30 days), with no known in-the-wild exploitation.

What to do: Upgrade Erlang/OTP to OTP 27.3.4.17, OTP 28.5.0.6, or OTP 29.0.6 (or later), which include the fixed inets versions 9.3.2.7, 9.6.2.3, and 9.7.2 respectively. Until patched, avoid fronting inets httpd with proxies or load balancers that accept or normalize obs-fold header lines, or configure the front end to reject folded headers; check which of your Erlang/OTP deployments expose httpd over the network and whether they sit behind a proxy.