{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73812", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-08-17T11:00:01.498Z", "datePublished": "2026-09-01T14:42:42.374Z", "dateUpdated": "2026-09-08T01:10:14.000Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [{"lessThan": "17.0", "status": "unknown", "version": "0", "versionType": "otp"}, {"lessThan": "27.3.4.17", "status": "affected", "version": "17.0", "versionType": "otp"}, {"lessThan": "28.5.0.6", "status": "affected", "version": "28.0", "versionType": "otp"}, {"lessThan": "29.0.6", "status": "affected", "version": "29.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "inets", "packageURL": "pkg:otp/inets", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "5.10", "status": "unknown", "version": "0", "versionType": "otp"}, {"lessThan": "9.3.2.7", "status": "affected", "version": "5.10", "versionType": "otp"}, {"lessThan": "9.6.2.3", "status": "affected", "version": "9.4", "versionType": "otp"}, {"lessThan": "9.7.2", "status": "affected", "version": "9.7", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "591dc00dc99dc2a426167a3b5257c0c94bd45e91", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.5.0.6", "versionStartIncluding": "28.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "29.0.6", "versionStartIncluding": "29.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak / Ericsson"}, {"lang": "en", "type": "finder", "value": "Lukas Backstr\u00f6m / Erlang Solutions"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;27.3.4.17, from OTP&nbsp;28.0 before OTP&nbsp;28.5.0.6, and from OTP&nbsp;29.0 before OTP&nbsp;29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>"}, {"base64": false, "type": "text/markdown", "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "impacts": [{"capecId": "CAPEC-33", "descriptions": [{"lang": "en", "value": "CAPEC-33 HTTP Request Smuggling"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 8.3, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-08T01:10:14.000Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-7j6m-4ffg-hg46"}, {"tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-73812.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-73812"}, {"tags": ["patch"], "url": "https://github.com/erlang/otp/commit/591dc00dc99dc2a426167a3b5257c0c94bd45e91"}], "source": {"discovery": "UNKNOWN"}, "title": "inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-01T15:56:32.935740Z", "id": "CVE-2026-73812", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T15:56:45.383Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73812", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-01T15:56:32.935740Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-01T15:56:35.712Z"}}], "cna": {"title": "inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak / Ericsson"}, {"lang": "en", "type": "finder", "value": "Lukas Backstr\u00f6m / Erlang Solutions"}], "impacts": [{"capecId": "CAPEC-33", "descriptions": [{"lang": "en", "value": "CAPEC-33 HTTP Request Smuggling"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "product": "OTP", "versions": [{"status": "unknown", "version": "0", "lessThan": "17.0", "versionType": "otp"}, {"status": "affected", "version": "17.0", "lessThan": "27.3.4.17", "versionType": "otp"}, {"status": "affected", "version": "28.0", "lessThan": "28.5.0.6", "versionType": "otp"}, {"status": "affected", "version": "29.0", "lessThan": "29.0.6", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "product": "OTP", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10", "versionType": "otp"}, {"status": "affected", "version": "5.10", "lessThan": "9.3.2.7", "versionType": "otp"}, {"status": "affected", "version": "9.4", "lessThan": "9.6.2.3", "versionType": "otp"}, {"status": "affected", "version": "9.7", "lessThan": "9.7.2", "versionType": "otp"}], "packageURL": "pkg:otp/inets", "packageName": "inets", "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "product": "OTP", "versions": [{"status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "lessThan": "591dc00dc99dc2a426167a3b5257c0c94bd45e91", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-7j6m-4ffg-hg46", "tags": ["vendor-advisory"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-73812.html", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-73812", "tags": ["related"]}, {"url": "https://github.com/erlang/otp/commit/591dc00dc99dc2a426167a3b5257c0c94bd45e91", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "supportingMedia": [{"type": "text/html", "value": "<p>httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;27.3.4.17, from OTP&nbsp;28.0 before OTP&nbsp;28.5.0.6, and from OTP&nbsp;29.0 before OTP&nbsp;29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>", "base64": false}, {"type": "text/markdown", "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.17"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.5.0.6", "versionStartIncluding": "28.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "29.0.6", "versionStartIncluding": "29.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-09-08T01:10:14.000Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73812", "state": "PUBLISHED", "dateUpdated": "2026-09-08T01:10:14.000Z", "dateReserved": "2026-08-17T11:00:01.498Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-09-01T14:42:42.374Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "vendor": "Erlang", "versions": [{"lessThan": "17.0", "status": "unknown", "version": "0", "versionType": "otp"}, {"lessThan": "27.3.4.17", "status": "affected", "version": "17.0", "versionType": "otp"}, {"lessThan": "28.5.0.6", "status": "affected", "version": "28.0", "versionType": "otp"}, {"lessThan": "29.0.6", "status": "affected", "version": "29.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "inets", "packageURL": "pkg:otp/inets", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "5.10", "status": "unknown", "version": "0", "versionType": "otp"}, {"lessThan": "9.3.2.7", "status": "affected", "version": "5.10", "versionType": "otp"}, {"lessThan": "9.6.2.3", "status": "affected", "version": "9.4", "versionType": "otp"}, {"lessThan": "9.7.2", "status": "affected", "version": "9.7", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"lessThan": "591dc00dc99dc2a426167a3b5257c0c94bd45e91", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "id": "CVE-2026-73812", "lastModified": "2026-09-08T01:17:54.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73812", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-01T15:56:32.935740Z", "version": "2.0.3"}}]}, "published": "2026-09-01T15:17:25.540", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-73812.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/commit/591dc00dc99dc2a426167a3b5257c0c94bd45e91"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://github.com/erlang/otp/security/advisories/GHSA-7j6m-4ffg-hg46"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-73812"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{"bugzilla": {"description": "OTP: inets: inets: HTTP Request Smuggling allows bypassing security controls", "id": "2526827", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526827"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "A flaw was found in the `inets` httpd server, part of Erlang/OTP. The server incorrectly processes HTTP requests that contain both `Transfer-Encoding: chunked` and `Content-Length` headers, failing to reject them or close the connection as required by RFC 9112 \u00a76.1. When `inets` is deployed behind a reverse proxy that prioritizes the `Content-Length` header, a remote attacker can exploit this discrepancy to smuggle malicious requests. This can lead to bypassing access controls, poisoning responses for other users, and circumventing authentication mechanisms enforced by the proxy."], "name": "CVE-2026-73812", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "cryostat/cryostat-storage-rhel9", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/volsync-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}], "public_date": "2026-09-01T14:42:42Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73812\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73812\nhttps://cna.erlef.org/cves/CVE-2026-73812.html\nhttps://github.com/erlang/otp/commit/591dc00dc99dc2a426167a3b5257c0c94bd45e91\nhttps://github.com/erlang/otp/security/advisories/GHSA-7j6m-4ffg-hg46\nhttps://osv.dev/vulnerability/EEF-CVE-2026-73812"], "threat_severity": "Important"}