CVE-2026-23941
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang…
Technology
Erlang/OTP
CVSS Score
9.4 / 10.0
Affected Versions
>=17.0 <26.2.5.18; >=27.0 <27.3.4.9; >=28.0 <28.4.1
Upstream Fix
See upstream advisory
Published
March 13, 2026
OSSeva Coverage
Fixed upstream
Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled b
Is your Erlang/OTP deployment affected?
If you're running >=17.0 <26.2.5.18; >=27.0 <27.3.4.9; >=28.0 <28.4.1, you need this patch. Book a discovery call to get covered.
View Erlang/OTP coverage →Get a quote
Running Erlang/OTP >=17.0 <26.2.5.18; >=27.0 <27.3.4.9; >=28.0 <28.4.1?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?