Executive brief
Erlang's inets HTTP server fails to detect simultaneous Transfer-Encoding and Content-Length headers in the same request, a condition that RFC 9112 flags as a probable smuggling attack. When a reverse proxy or load balancer (favoring Content-Length) sits in front of an inets server (favoring Transfer-Encoding chunked encoding), an attacker can craft malicious requests that are parsed differently at each layer, potentially smuggling injected requests past security controls or poisoning HTTP caches to serve malicious content to other users.
Technical details
The vulnerability is an HTTP request smuggling flaw (CWE-444) in Erlang's inets httpd module. The root cause is that the check_header/3 function rejects only duplicate Content-Length headers (a fix for CVE-2026-23941) but does not validate the RFC 9112 §6.3 requirement that Transfer-Encoding and Content-Length must not both be present. The handle_body/3 function frames requests by Transfer-Encoding: chunked and silently discards the Content-Length header. When a CL-preferring front-end (e.g., a reverse proxy) is paired with a TE-preferring inets backend, an attacker can send a crafted request with both headers; the front-end interprets the Content-Length boundary while the backend uses the chunked encoding, desynchronizing the parsing and allowing the attacker to inject a second request that only the backend processes. The vulnerability is fixed in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 (inets 9.3.2.7, 9.6.2.3, and 9.7.2 respectively).
Affected products
- Erlang OTP 17.0 to 27.3.4.16, 28.0 to 28.5.0.5, 29.0 to 29.0.5
- Erlang inets 5.10 to 9.3.2.6, 9.4 to 9.6.2.2, 9.7 to 9.7.1
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Patches released for OTP 27.3.4.17, 28.5.0.6, and 29.0.6