CVE-2026-66835

CVE-2026-66835 is a path equivalence flaw (CWE-50) in the httpd web server of Erlang/OTP's inets application that lets a remote, unauthenticated attacker read files inside directories protected by mod_auth without supplying credentials. Because URI normalization leaves empty path segments intact, a doubled slash in the request path survives; when the document root is prepended, that doubled slash breaks the regular expression mod_auth uses to recognize a protected directory, so no authentication challenge is issued, while the operating system collapses the doubled slash when the file is opened and the protected file is served anyway. The same path mismatch also evades the per-path accounting in mod_security. Anyone running httpd with mod_auth-protected directories on OTP 17.0 up to (excluding) 27.3.4.17, OTP 28.0 up to (excluding) 28.5.0.6, or OTP 29.0 up to (excluding) 29.0.6 (inets 5.10 up to 9.3.2.7, 9.4 up to 9.6.2.3, and 9.7 up to 9.7.2 respectively) is affected; whether OTP releases before 17.0 are affected is unknown. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists, and EPSS assigns roughly a 0.6% probability of exploitation within 30 days.

What to do: Upgrade Erlang/OTP to 27.3.4.17, 28.5.0.6, or 29.0.6 as applicable, which correspond to fixed inets versions 9.3.2.7, 9.6.2.3, and 9.7.2. As an interim measure, front httpd with a reverse proxy that rejects or normalizes requests containing doubled slashes, or restrict access to mod_auth-protected directories elsewhere. Inventory httpd virtual hosts for mod_auth directory blocks and review access logs for requests with doubled slashes against protected paths.