CVE-2026-73812: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Erlang OTP

CVE-2026-73812 affects Erlang OTP's HTTP server (httpd) and is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests). The vulnerability arises because the check_header/3 function rejects duplicate Content-Length headers but fails to detect the coexistence of Transfer-Encoding and Content-Length headers in the same request. According to RFC 9112 §6.3, the presence of both headers is a likely indicator of HTTP request smuggling attempts. This flaw can cause desynchronization between front-end and back-end HTTP processing components, particularly when the front-end prefers Content-Length and the back-end prefers chunked Transfer-Encoding. The vulnerability impacts multiple Erlang OTP and inets versions as specified, with a CVSS 4.0 score of 8.3 indicating high severity. No vendor advisory or patch links are provided in the data.

The vulnerability can lead to HTTP request/response smuggling attacks due to inconsistent interpretation of HTTP headers by the Erlang OTP HTTP server. This may cause desynchronization between front-end and back-end HTTP processing, potentially allowing attackers to bypass security controls or interfere with HTTP traffic handling. The CVSS score of 8.3 reflects a high severity impact with network attack vector, low attack complexity, no privileges required, no user interaction, low confidentiality impact, high integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor Erlang OTP advisories for updates. No specific mitigations or temporary fixes are provided in the available data.