The vulnerability in Erlang OTP's inets httpd module (httpd_request:parse_headers/7) involves inconsistent handling of duplicate Content-Length headers in HTTP requests. The server uses the first Content-Length header to parse the body, whereas common reverse proxies (nginx, Apache httpd, Envoy) use the last Content-Length header. This mismatch leads to HTTP Request Smuggling, violating RFC 9112 Section 6.3, and can cause desynchronization between front-end and back-end servers. Affected versions include OTP 17.0 through OTP 28.4.1 and related inets versions. The CVSS 4.0 score is 7.0, indicating high severity. No vendor advisory or patch information is currently available.

This vulnerability can lead to front-end/back-end desynchronization in HTTP request processing, allowing an attacker to smuggle HTTP requests. This may result in attacker-controlled bytes being interpreted as part of subsequent requests, potentially enabling request hijacking or bypassing security controls. The impact is limited to affected Erlang OTP versions running the vulnerable inets httpd module. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Erlang's official channels for updates. In the meantime, consider deploying reverse proxies or web application firewalls that can detect and mitigate HTTP request smuggling attempts as a temporary measure.