This vulnerability in Erlang OTP's inets httpd module (httpd_request:parse_headers/7) involves inconsistent handling of duplicate Content-Length headers in HTTP requests. The server uses the first Content-Length header to parse the body, whereas common reverse proxies honor the last Content-Length header. This inconsistency violates RFC 9112 Section 6.3, leading to front-end/back-end desynchronization and enabling HTTP Request Smuggling attacks. Affected versions include OTP from 17.0 before 28.4.1, 27.3.4.9, and 26.2.5.18, corresponding to inets versions 5.10 before 9.6.1, 9.3.2.3, and 9.1.0.5. No official patch or remediation details are provided in the input data.

The vulnerability allows an attacker to perform HTTP Request Smuggling by exploiting inconsistent interpretation of duplicate Content-Length headers between the Erlang OTP server and front-end reverse proxies. This can cause request desynchronization, potentially enabling attackers to inject malicious requests or interfere with legitimate traffic. The CVSS 4.0 score of 7 indicates high severity with network attack vector, high scope impact, and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Erlang OTP vendor advisories for updates. Until a fix is available, consider deploying additional protections at the proxy or firewall level to detect or block suspicious HTTP requests with duplicate Content-Length headers.