CVE-2026-73276

Erlang/OTP's inets application ships a built-in HTTP server (httpd), and its 'gracefulness' handling code fails to reject certain HTTP requests that should be discarded, creating request-parsing inconsistencies (CWE-444). An attacker triggers the flaw by sending crafted, ambiguous HTTP requests to an httpd endpoint, typically one sitting behind a reverse proxy, load balancer, or other HTTP intermediary. The resulting desynchronization allows HTTP request smuggling, letting an attacker smuggle past front-end controls, tamper with requests (CVSS 4.0 rates integrity impact high), or potentially poison caches and hijack other users' requests. Any deployment running an affected OTP 22.2-27.x, 28.x, or 29.x release with inets httpd enabled is affected; sites using Erlang/OTP without httpd are not. There is no known public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation within 30 days, so no in-the-wild exploitation is currently known.

What to do: Upgrade Erlang/OTP to at least OTP 27.3.4.17, 28.5.0.6, or 29.0.6 (i.e., inets 9.3.2.7, 9.6.2.3, or 9.7.2 respectively, or later). Check whether your OTP deployments actually start inets httpd (e.g., running embedded management or HTTP endpoints); if httpd is not enabled, you are not affected. As an interim measure, restrict direct network access to httpd listeners and ensure any front-end proxy normalizes request framing.