CVE-2026-73276: Erlang OTP inets HTTP request smuggling via header whitespace

CVE-2026-73276 · Severity: info · CVSS 8.3 · Published 2026-09-01

Erlang's OTP inets library, which provides HTTP server functionality for applications built on Erlang, contains a flaw in HTTP request parsing that allows attackers to bypass input validation through malformed headers. This vulnerability enables HTTP request smuggling attacks, where an attacker can inject crafted requests that are interpreted differently by proxies and backend servers, potentially leading to cache poisoning, session hijacking, or unauthorized access to protected resources.

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-73276 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-73276 being exploited in the wild.
How severe is CVE-2026-73276?
Informational severity, with a CVSS score of 8.3, published 1 September 2026.
Which products and versions are affected?
Erlang Inets 7.1.2 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2; Erlang OTP 22.2 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.
Is there a fix for CVE-2026-73276?
A patch was published on 2026-09-01: Patches available as OTP 27.3.4.17, 28.5.0.6, 29.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73276 attacked?
It is attacked over the network.
Am I affected by CVE-2026-73276?
Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability (CWE-444) stems from a flaw in the "gracefulness" code of the inets HTTP parser that fails to reject certain malformed HTTP headers, specifically those with whitespace before the colon delimiter. Instead of properly validating and rejecting these cases, the parser silently drops or mishandles them, leading to inconsistent interpretation between different HTTP implementations. An attacker can craft requests with whitespace-before-colon headers that are accepted by the Erlang inets server but interpreted differently by upstream proxies or other HTTP agents, enabling request smuggling attacks. The vulnerability is network-accessible with no authentication required; exploitation does require precise timing and knowledge of the downstream stack (AT:P). Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+, corresponding to inets 9.3.2.7+, 9.6.2.3+, and 9.7.2+.

Affected products

  • Erlang OTP 22.2 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
  • Erlang inets 7.1.2 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2

Timeline

  • 2026-09-01: disclosed
  • 2026-09-01: patched: Patches available as OTP 27.3.4.17, 28.5.0.6, 29.0.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.