{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73276", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-12T20:00:01.107Z", "datePublished": "2026-09-01T14:41:24.565Z", "dateUpdated": "2026-09-08T01:10:02.081Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [{"lessThan": "27.3.4.17", "status": "affected", "version": "22.2", "versionType": "otp"}, {"lessThan": "28.5.0.6", "status": "affected", "version": "28.0", "versionType": "otp"}, {"lessThan": "29.0.6", "status": "affected", "version": "29.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "inets", "packageURL": "pkg:otp/inets", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "9.3.2.7", "status": "affected", "version": "7.1.2", "versionType": "otp"}, {"lessThan": "9.6.2.3", "status": "affected", "version": "9.4", "versionType": "otp"}, {"lessThan": "9.7.2", "status": "affected", "version": "9.7", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "60add5a19e2154560fdff3fe92dba14a68bbd683", "status": "unaffected"}, {"at": "6cd995e34d3bb3d36dd278dded2d62c25e71820c", "status": "unaffected"}, {"at": "c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "c06db0bedf49a9b40725745e73fa82e562612815", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.17", "versionStartIncluding": "22.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.5.0.6", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "29.0.6", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak / Ericsson"}, {"lang": "en", "type": "reporter", "value": "Lukas Backstr\u00f6m / Erlang Solutions"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.</p>\n<p>This issue affects OTP from OTP&nbsp;22.2 before OTP&nbsp;27.3.4.17, from OTP&nbsp;28.0 before OTP&nbsp;28.5.0.6, and from OTP&nbsp;29.0 before OTP&nbsp;29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.</p>"}, {"base64": false, "type": "text/markdown", "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\u00a022.2 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2."}], "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\u00a022.2 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2."}], "impacts": [{"capecId": "CAPEC-33", "descriptions": [{"lang": "en", "value": "CAPEC-33 HTTP Request Smuggling"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.3, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-08T01:10:02.081Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-73276.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-73276"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f"}], "source": {"discovery": "UNKNOWN"}, "title": "inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-01T15:55:23.919951Z", "id": "CVE-2026-73276", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T15:55:30.190Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73276", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T15:55:23.919951Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T15:55:26.784Z"}}], "cna": {"title": "inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak / Ericsson"}, {"lang": "en", "type": "reporter", "value": "Lukas Backstr\u00f6m / Erlang Solutions"}], "impacts": [{"capecId": "CAPEC-33", "descriptions": [{"lang": "en", "value": "CAPEC-33 HTTP Request Smuggling"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "version": "22.2", "lessThan": "27.3.4.17", "versionType": "otp"}, {"status": "affected", "version": "28.0", "lessThan": "28.5.0.6", "versionType": "otp"}, {"status": "affected", "version": "29.0", "lessThan": "29.0.6", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "version": "7.1.2", "lessThan": "9.3.2.7", "versionType": "otp"}, {"status": "affected", "version": "9.4", "lessThan": "9.6.2.3", "versionType": "otp"}, {"status": "affected", "version": "9.7", "lessThan": "9.7.2", "versionType": "otp"}], "packageURL": "pkg:otp/inets", "packageName": "inets", "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "60add5a19e2154560fdff3fe92dba14a68bbd683", "status": "unaffected"}, {"at": "6cd995e34d3bb3d36dd278dded2d62c25e71820c", "status": "unaffected"}, {"at": "c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f", "status": "unaffected"}], "version": "c06db0bedf49a9b40725745e73fa82e562612815", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p", "tags": ["vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-73276.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-73276", "tags": ["related"]}, {"url": "https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\u00a022.2 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.", "supportingMedia": [{"type": "text/html", "value": "<p>Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.</p>\n<p>This issue affects OTP from OTP&nbsp;22.2 before OTP&nbsp;27.3.4.17, from OTP&nbsp;28.0 before OTP&nbsp;28.5.0.6, and from OTP&nbsp;29.0 before OTP&nbsp;29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.</p>", "base64": false}, {"type": "text/markdown", "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\u00a022.2 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.17", "versionStartIncluding": "22.2"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.5.0.6", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.0.6", "versionStartIncluding": "29.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-08T01:10:02.081Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73276", "state": "PUBLISHED", "dateUpdated": "2026-09-08T01:10:02.081Z", "dateReserved": "2026-08-12T20:00:01.107Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-09-01T14:41:24.565Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [{"lessThan": "27.3.4.17", "status": "affected", "version": "22.2", "versionType": "otp"}, {"lessThan": "28.5.0.6", "status": "affected", "version": "28.0", "versionType": "otp"}, {"lessThan": "29.0.6", "status": "affected", "version": "29.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "inets", "packageURL": "pkg:otp/inets", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "9.3.2.7", "status": "affected", "version": "7.1.2", "versionType": "otp"}, {"lessThan": "9.6.2.3", "status": "affected", "version": "9.4", "versionType": "otp"}, {"lessThan": "9.7.2", "status": "affected", "version": "9.7", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "60add5a19e2154560fdff3fe92dba14a68bbd683", "status": "unaffected"}, {"at": "6cd995e34d3bb3d36dd278dded2d62c25e71820c", "status": "unaffected"}, {"at": "c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "c06db0bedf49a9b40725745e73fa82e562612815", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\u00a022.2 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2."}], "id": "CVE-2026-73276", "lastModified": "2026-09-08T01:17:53.980", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73276", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-01T15:55:23.919951Z", "version": "2.0.3"}}]}, "published": "2026-09-01T15:17:25.367", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-73276.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-73276"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "otp: inets: OTP inets httpd: HTTP Request Smuggling vulnerability via malformed headers", "id": "2526829", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526829"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\nThis issue affects OTP from OTP\u00a022.2 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.", "A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that tolerates such malformed headers, the httpd server may misinterpret subsequent requests, leading to potential security bypasses or cache poisoning."], "mitigation": {"lang": "en:us", "value": "Update to Erlang/OTP 27.3.4.17, 28.5.0.6, or 29.0.6 or later when updates become available through Red Hat channels. For Red Hat products shipping Erlang (OpenStack 16.2, 17.1, 18.0, EPEL), the vulnerable inets httpd component is not used by default. RabbitMQ uses the Cowboy HTTP server for its management interface, not inets httpd. To verify that inets httpd is not running in your environment, check that no Erlang processes are configured to start the inets httpd server via application configuration files.\nIf you have custom Erlang applications that explicitly use inets httpd, ensure they are not deployed behind reverse proxies that tolerate malformed HTTP headers, or configure the proxy to strictly reject requests with whitespace between HTTP header field names and colons.\nFor most Red Hat deployments, no immediate action is required beyond normal update procedures, as the vulnerable component is not exposed."}, "name": "CVE-2026-73276", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Fix deferred", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/traefik-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-09-01T14:41:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73276\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73276\nhttps://cna.erlef.org/cves/CVE-2026-73276.html\nhttps://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683\nhttps://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c\nhttps://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f\nhttps://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p\nhttps://osv.dev/vulnerability/EEF-CVE-2026-73276"], "statement": "A flaw was found in the Erlang/OTP inets httpd server where HTTP headers containing whitespace between the field-name and colon are silently accepted rather than rejected. When deployed behind a reverse proxy that tolerates such malformed headers, this can lead to HTTP Request Smuggling, allowing attackers to bypass security controls or poison caches.\nRed Hat ships Erlang in OpenStack 16.2 (version 23.3.4.18), OpenStack 17.1 (version 24.3.4.2), OpenStack 18.0 (version 26.2.5.21), and EPEL (version 26.2.5), which include versions of the inets library affected by this vulnerability. However, Red Hat products ship Erlang exclusively as a runtime dependency for RabbitMQ, the AMQP message broker used for inter-service messaging.\nRabbitMQ does not use the vulnerable inets httpd component; its management plugin and HTTP API use the Cowboy HTTP server instead. The inets httpd server would require explicit configuration via Erlang application settings to be enabled, and there is no evidence that any Red Hat product configures, enables, or exposes this component. The inets library is present only for its HTTP client functionality, not the httpd server module.\nTherefore, while the Erlang package versions are technically in the affected range, the vulnerable code path is not reachable in Red Hat's default shipping configurations, resulting in a LOW security impact. Red Hat Hummingbird 1 ships Erlang version 27.3.4.17, which is the fixed version and is not affected.", "threat_severity": "Low"}