# CVE-2026-48856: Erlang OTP sensitive header leak in inets httpc redirect

Source: https://junglewise.ai/threats/cve-2026-48856-erlang-otp-sensitive-header-leak-in-inets-httpc-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-48856 · Severity: info · CVSS 7.1 · Published 2026-06-10

A security flaw in the Erlang HTTP client (httpc) can allow attackers to steal sensitive login credentials. When the client is redirected from one website to another, it incorrectly sends the original site's secret authorization tokens to the new, potentially malicious destination. This could lead to unauthorized account access or the exposure of private data if an application connects to a server controlled by an attacker.

Technologies: [Erlang Inets](https://junglewise.ai/threats/technologies/inets), [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-48856 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48856 being exploited in the wild.

**How severe is CVE-2026-48856?** Informational severity, with a CVSS score of 7.1, published 10 June 2026.

**Which products and versions are affected?** Erlang Inets 5.10 to 9.3.2.5, 9.4.0 to 9.6.2.1, 9.7.0; Erlang OTP 17.0 to 27.3.4.12, 28.0 to 28.5.0.1, 29.0 to 29.0.1.

**Is there a fix for CVE-2026-48856?** A patch was published on 2026-06-10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48856 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48856?** Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A sensitive data exposure vulnerability exists in the Erlang OTP inets httpc_response module. The httpc client fails to verify origin boundaries during HTTP redirects (3xx responses), causing it to forward Authorization and Proxy-Authorization headers verbatim to the redirect target. Because 'autoredirect' is enabled by default, any application using httpc to contact a malicious or compromised server can be forced into a cross-origin redirect where its credentials are leaked to an attacker-controlled host. The vulnerability is rooted in httpc_response:redirect/2, which updates the host field but fails to strip sensitive headers when the host or port changes. Patches are available in OTP versions 29.0.2, 28.5.0.2, and 27.3.4.13.

## Affected products

- Erlang OTP 17.0 to 27.3.4.12, 28.0 to 28.5.0.1, 29.0 to 29.0.1
- Erlang inets 5.10 to 9.3.2.5, 9.4.0 to 9.6.2.1, 9.7.0

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-10: patched

## References

- [https://cna.erlef.org/cves/CVE-2026-48856.html](https://cna.erlef.org/cves/CVE-2026-48856.html)
- [https://github.com/erlang/otp/commit/688d748d6f7a6a06b13b662a1d3de8af97079612](https://github.com/erlang/otp/commit/688d748d6f7a6a06b13b662a1d3de8af97079612)
- [https://github.com/erlang/otp/security/advisories/GHSA-m75x-4vwg-ggjh](https://github.com/erlang/otp/security/advisories/GHSA-m75x-4vwg-ggjh)
- [https://www.erlang.org/doc/system/versions.html](https://www.erlang.org/doc/system/versions.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)