CVE-2026-73812 is a high-severity vulnerability in Erlang OTP's HTTP server (httpd) involving inconsistent interpretation of HTTP requests, specifically HTTP request/response smuggling. The vulnerability occurs because the httpd function check_header/3 rejects duplicate Content-Length headers but does not check for the simultaneous presence of Transfer-Encoding and Content-Length headers, which RFC 9112 §6.3 identifies as a probable smuggling attempt. This can lead to desynchronization between front-end and back-end HTTP processing when a Content-Length-preferring front-end is paired with a chunked-preferring back-end. Multiple OTP and inets versions are affected. No explicit patch information is provided.
CVE-2026-73276 is a high-severity vulnerability in Erlang OTP that involves inconsistent interpretation of HTTP requests, specifically in the Gracefulness code. This flaw allows HTTP Request Smuggling attacks by ignoring certain cases that should have been rejected. The vulnerability affects multiple OTP versions from 22.2 up to but not including 27.3.4.17, 28.0 up to but not including 28.5.0.6, and 29.0 up to but not including 29.0.6, as well as corresponding inets versions. It has a CVSS 4.0 score of 8.3, indicating high severity. No vendor advisory or patch information is currently available.
CVE-2026-66357 is a high-severity vulnerability in Erlang OTP's httpd component related to inconsistent interpretation of HTTP requests, specifically HTTP request/response smuggling. The issue arises because httpd never implemented obs-fold (header continuation lines) as specified in RFC 2616 and RFC 7230, causing every CRLF followed by a non-CRLF octet to start a new header unconditionally. This behavior can lead to security concerns as it deviates from expected HTTP parsing, potentially enabling request smuggling attacks. The vulnerability affects multiple OTP and inets versions prior to specific fixed releases.
CVE-2026-55951 is a high-severity vulnerability in the Erlang/OTP httpc HTTP client where no limit is enforced on the total size of response headers from a server. This allows a malicious or compromised HTTP server to send an arbitrarily large number or size of headers, causing unbounded memory allocation in the client process. This can lead to system memory exhaustion or a crash of the BEAM VM. The vulnerability affects multiple OTP versions from 17.0 up to but excluding 27.3.4.17, 28.0 up to but excluding 28.5.0.6, and 29.0 up to but excluding 29.0.6, as well as corresponding inets versions. Any application using httpc:request/4,5 to connect to untrusted servers is vulnerable without requiring authentication.
CVE-2026-74994 is an incorrect authorization vulnerability in the mod_auth module of Erlang OTP's inets httpd server. When configured with dets or mnesia authentication backends and multiple directory configuration blocks, all directory blocks share a single user/group namespace. This causes a user authorized for one protected directory to be accepted for all other protected directories on the same server instance. The vulnerability affects multiple OTP and inets versions prior to specific fixed releases.
CVE-2026-74835 is a high-severity vulnerability in the Erlang OTP inets HTTP server where the configured body-size limit on chunked HTTP requests is not enforced. This flaw allows resource exhaustion due to allocation without limits or throttling. The issue affects multiple OTP and inets versions and has a CVSS 4.0 base score of 8.7. The vulnerability is fixed in OTP versions 27.3.4.17, 28.5.0.6, 29.0.6 and inets versions 9.3.2.7, 9.6.2.3, and 9.7.2. No known exploits are reported in the wild.
CVE-2026-66835 is a path equivalence vulnerability in the Erlang/OTP inets httpd server that allows remote unauthenticated attackers to bypass mod_auth directory protections by using multiple leading slashes in the request path. This causes the authentication check to fail due to a mismatch in path normalization and regex matching, enabling unauthorized file reads within protected directories. The vulnerability affects multiple OTP and inets versions prior to specific fixed releases.
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.
The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.
This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.
CVE-2026-73270 is a high-severity vulnerability in Erlang/OTP's inets httpd module that improperly handles case sensitivity on case-insensitive filesystems. It allows remote unauthenticated attackers to bypass mod_auth directory protections by requesting files with different casing, leading to unauthorized file disclosure. This affects multiple OTP and inets versions prior to specific fixed releases. Case-sensitive filesystems are not affected.
CVE-2026-71380 is a high-severity vulnerability in Erlang/OTP's inets httpd component that allows an unauthenticated remote attacker to cause a denial of service. The flaw arises from improper resource release after receiving partial HTTP request bodies with large Content-Length headers, leading to indefinite worker occupation. This affects multiple OTP and inets versions prior to specific fixed releases.
CVE-2026-71562 is a medium severity vulnerability in Erlang/OTP's inets httpc module involving improper validation of numeric header values. A malicious HTTP server can send a very long numeric header (e.g., Content-Length) that triggers expensive arbitrary-precision integer conversions, causing performance degradation. This affects multiple OTP and inets versions prior to specific patch releases.
CVE-2026-70399 is a denial-of-service vulnerability in Erlang/OTP inets httpd caused by allocation of resources without limits or throttling. An unauthenticated remote attacker can open and hold many simultaneous connections, exhausting server resources. The default max_clients limit of 150 is not applied if the option is not explicitly set, allowing unlimited connections. This affects multiple OTP and inets versions prior to specific fixed releases.
Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data.
The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization and proxy_authorization) are copied verbatim. The redirect target host is never compared against the original host.
autoredirect defaults to true, so this affects all httpc callers that do not explicitly disable automatic redirects.
An attacker who controls a server that the victim contacts via httpc can issue a cross-origin 3xx redirect to a server they also control. The Authorization header (including Basic credentials derived from URL userinfo via httpc_request:handle_user_info/2) is forwarded to the redirect target, allowing credential theft. The same applies to the Proxy-Authorization header.
This vulnerability is associated with program files lib/inets/src/http_client/httpc_response.erl.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to inets from 5.10 before 9.3.2.8, 9.6.2.4, and 9.8.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV response IP address.
The ftp_internal:handle_ctrl_result/2 PASV handler (mode=passive, ipfamily=inet, ftp_extension=false) extracts the IP address from the server's 227 response and passes it directly to gen_tcp:connect/4 without validating it against the control connection peer address. The adjacent EPSV handlers correctly call peername(CSock) to derive the IP from the control connection, but the PASV handler does not. A malicious or compromised FTP server can redirect the client's data connection to an arbitrary internal host and port. On read operations (ftp:ls/1,2, ftp:nlist/1,2, ftp:recv/2,3), data from the redirected target is returned to the caller. On write operations (ftp:send/2,3, ftp:append/2,3), file content is sent to the redirected target. This enables SSRF against internal hosts, cloud metadata endpoints, and FTP bounce attacks against third-party hosts.
The vulnerable path is the default configuration (mode=passive, ipfamily=inet, ftp_extension=false). RFC 2577 section 3 explicitly recommends validating the PASV response IP against the control connection peer.
The ftp application is deprecated and scheduled for removal in OTP-30.
This vulnerability is associated with program files lib/inets/src/ftp/ftp_internal.erl (inets 5.10.4 through 6.5, OTP 17.4 through 20.3) and lib/ftp/src/ftp_internal.erl (ftp 1.0 and later, OTP 21.0 and later).
This issue affects OTP from OTP 17.4 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to inets from 5.10.4 before 7.0 and ftp from 1.0 before 1.2.6, 1.2.4.1 and 1.2.3.1.
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.
When script_alias maps a URL prefix to a directory outside DocumentRoot, mod_auth evaluates directory-based access controls against the DocumentRoot-relative path while mod_cgi executes the script at the ScriptAlias-resolved path. This path mismatch allows unauthenticated access to CGI scripts that directory rules were meant to protect.
This vulnerability is associated with program files lib/inets/src/http_server/mod_alias.erl, lib/inets/src/http_server/mod_auth.erl, and lib/inets/src/http_server/mod_cgi.erl.
This issue affects OTP from OTP 17.0 before OTP 26.2.5.19, OTP 27.3.4.10, and OTP 28.4.2, corresponding to inets from 5.10 before 9.1.0.6, 9.3.2.4, and 9.6.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.
This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.
The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.
This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5.
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.
This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0.