Executive brief
Erlang's httpd HTTP server has never correctly implemented RFC-compliant header continuation lines (obs-fold), treating every line break as a new header instead. This oversight enables HTTP request smuggling attacks, where attackers craft malformed requests that are parsed differently by httpd and downstream proxies or application logic, potentially bypassing security controls or poisoning request interpretation. Systems using affected Erlang/OTP versions to serve HTTP content are vulnerable to request smuggling exploitation in the wild.
Technical details
The vulnerability is a CWE-444 HTTP request smuggling defect stemming from httpd's failure to implement obs-fold header continuation (RFC 2616 §2.2 and RFC 7230 §3.2.4). Instead of treating a CRLF followed by whitespace as a header continuation, httpd unconditionally begins a new header at each CRLF, creating a discrepancy in HTTP request parsing between httpd and compliant intermediaries. An attacker can send a crafted HTTP request with malformed headers over the network to a vulnerable httpd instance, causing smuggled content to be interpreted differently by proxies, WAFs, or backend application logic. This enables cache poisoning, request injection, or session hijacking depending on the deployment topology. Patches are available: OTP 27.3.4.17+, OTP 28.5.0.6+, and OTP 29.0.6+ (inets 9.3.2.7+, 9.6.2.3+, and 9.7.2+ respectively).
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2
Timeline
- 2026-09-01: disclosed
- 2026-09-08: advisory: CNA advisory published