# CVE-2026-23941: Erlang OTP HTTP Request Smuggling in inets httpd

Source: https://junglewise.ai/threats/cve-2026-23941-erlang-otp-http-request-smuggling-in-inets-httpd  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-13. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-23941 · Severity: critical · CVSS 9.4 · Published 2026-03-13

A vulnerability in the Erlang OTP web server module (inets httpd) could allow attackers to bypass security controls or hijack user sessions. By sending specially crafted web requests with conflicting information, an attacker can 'smuggle' hidden commands past a security proxy directly to the backend server. This can lead to unauthorized access to sensitive data, cache poisoning, or the disruption of legitimate user requests.

## Quick answers

**Is CVE-2026-23941 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23941 being exploited in the wild.

**How severe is CVE-2026-23941?** Critical severity, with a CVSS score of 9.4, published 13 March 2026.

**Which products and versions are affected?** Erlang OTP 17.0 to 26.2.5.17, 27.0 to 27.3.4.8, 28.0 to 28.4.0; Erlang inets 5.10 to 9.1.0.4, 9.3 to 9.3.2.2, 9.6 to 9.6.0.

**Is there a fix for CVE-2026-23941?** A patch was published on 2026-03-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23941 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-23941?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Erlang OTP 'inets' httpd module fails to properly validate or reject requests containing multiple Content-Length headers, violating RFC 9112 Section 6.3. The server follows a 'first-wins' strategy, parsing the body based on the earliest Content-Length header, while many common reverse proxies (like Nginx or Apache) follow a 'last-wins' strategy. An attacker can exploit this discrepancy to desynchronize the connection, leaving malicious bytes in the server's buffer that are interpreted as the start of a subsequent request. This can result in authentication bypass, request hijacking, or web cache poisoning. The issue is fixed in OTP versions 28.4.1, 27.3.4.9, and 26.2.5.18.

## Affected products

- Erlang OTP 17.0 to 26.2.5.17, 27.0 to 27.3.4.8, 28.0 to 28.4.0
- Erlang inets 5.10 to 9.1.0.4, 9.3 to 9.3.2.2, 9.6 to 9.6.0

## Timeline

- 2026-03-13: disclosed
- 2026-03-13: advisory
- 2026-03-13: patched

## References

- [https://cna.erlef.org/cves/CVE-2026-23941.html](https://cna.erlef.org/cves/CVE-2026-23941.html)
- [https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18](https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18)
- [https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b](https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b)
- [https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6](https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6)
- [https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7](https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)