CVE-2026-73276: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Erlang OTP
Description
CVE-2026-73276 is a high-severity vulnerability in Erlang OTP that involves inconsistent interpretation of HTTP requests, specifically in the Gracefulness code. This flaw allows HTTP Request Smuggling attacks by ignoring certain cases that should have been rejected. The vulnerability affects multiple OTP versions from 22.2 up to but not including 27.3.4.17, 28.0 up to but not including 28.5.0.6, and 29.0 up to but not including 29.0.6, as well as corresponding inets versions. It has a CVSS 4.0 score of 8.3, indicating high severity. No vendor advisory or patch information is currently available.
CVSS v4.0
Score 8.3high
Affected software
Erlang
OTP
Erlang
OTP
Erlang
OTP
pkg:github/inetscpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73276 is a vulnerability in Erlang OTP's HTTP handling, specifically due to inconsistent interpretation of HTTP requests in the Gracefulness code path. This inconsistency leads to HTTP Request Smuggling opportunities, where crafted HTTP requests can be interpreted differently by front-end and back-end servers, potentially allowing attackers to bypass security controls or interfere with request processing. The affected versions include OTP releases from 22.2 to before 27.3.4.17, 28.0 to before 28.5.0.6, and 29.0 to before 29.0.6, plus related inets versions. The CVSS 4.0 base score is 8.3, reflecting a high-severity issue. No official patch or vendor advisory details are provided in the input data.
Potential Impact
The vulnerability enables HTTP Request Smuggling attacks due to inconsistent HTTP request parsing, which can lead to bypassing security controls or manipulating HTTP traffic. The CVSS score of 8.3 indicates a high impact, but no specific exploitation details or known active exploits are reported. The flaw affects multiple Erlang OTP versions and could impact applications relying on these versions for HTTP handling.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or mitigations are released, users should monitor Erlang OTP vendor communications for updates. No vendor advisory or official fix information is currently available.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-08-12T20:00:01.107Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a96e6ecacd9273b49d71687
Added to database: 09/01/2026, 14:53:32 UTC
Last enriched: 09/29/2026, 04:50:34 UTC
Last updated: 10/16/2026, 06:48:18 UTC
Views: 103
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.