CVE-2026-66357: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Erlang OTP
Description
CVE-2026-66357 is a high-severity vulnerability in Erlang OTP's httpd component related to inconsistent interpretation of HTTP requests, specifically HTTP request/response smuggling. The issue arises because httpd never implemented obs-fold (header continuation lines) as specified in RFC 2616 and RFC 7230, causing every CRLF followed by a non-CRLF octet to start a new header unconditionally. This behavior can lead to security concerns as it deviates from expected HTTP parsing, potentially enabling request smuggling attacks. The vulnerability affects multiple OTP and inets versions prior to specific fixed releases.
CVSS v4.0
Score 8.3high
Affected software
Erlang
OTP
Erlang
OTP
Erlang
OTP
pkg:github/inetscpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-66357 in Erlang OTP's httpd component stems from the lack of implementation of obs-fold (header continuation lines) per HTTP standards (RFC 2616 §2.2 and RFC 7230 §3.2.4). This causes the server to treat every CRLF followed by a non-CRLF octet as the start of a new header, leading to inconsistent HTTP request parsing. Such inconsistency is a known vector for HTTP request/response smuggling attacks. Affected versions include OTP from 17.0 up to but excluding 27.3.4.17, 28.0 up to but excluding 28.5.0.6, and 29.0 up to but excluding 29.0.6, as well as corresponding inets versions. It is unknown if versions before OTP 17.0 are affected.
Potential Impact
This vulnerability can allow attackers to perform HTTP request/response smuggling due to inconsistent parsing of HTTP headers, potentially leading to security issues such as bypassing security controls or injecting malicious requests. The CVSS 4.0 score of 8.3 indicates a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, low confidentiality impact, high integrity impact, no availability impact, and no scope change.
Mitigation Recommendations
A fix is available in Erlang OTP versions 27.3.4.17, 28.5.0.6, and 29.0.6 and corresponding inets versions 9.3.2.7, 9.6.2.3, and 9.7.2. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying these updates. Patch status is confirmed by the version ranges provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-08-17T20:00:02.207Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a96e6ecacd9273b49d7167b
Added to database: 09/01/2026, 14:53:32 UTC
Last enriched: 09/29/2026, 04:51:18 UTC
Last updated: 10/16/2026, 06:48:18 UTC
Views: 86
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.