httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Erlang
  • Erlang/otp
  • Erlang\/otp
  • Otp

No data.

No data.

References
Link Providers
https://cna.erlef.org/cves/CVE-2026-66357.html cve-icon cve-icon
https://github.com/erlang/otp/commit/220d618d2479a7180b4a06d0c5aacfaa4af4a85b cve-icon cve-icon
https://github.com/erlang/otp/commit/273d8958de38ff2a7fe0c5dcc5b6bfe6f65717f3 cve-icon cve-icon
https://github.com/erlang/otp/commit/e640d599287d2eba919e6f13b91f042d7dbe6ff4 cve-icon cve-icon
https://github.com/erlang/otp/security/advisories/GHSA-qh2f-33hj-37qf cve-icon cve-icon
https://osv.dev/vulnerability/EEF-CVE-2026-66357 cve-icon cve-icon
History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Title inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-444
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 8.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:L/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-09-01T14:40:50.526Z

Updated: 2026-09-01T15:56:07.942Z

Reserved: 2026-08-17T20:00:02.207Z

Link: CVE-2026-66357

cve-icon Vulnrichment

Updated: 2026-09-01T15:56:05.116Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T15:17:23.047

Modified: 2026-09-01T21:15:00.147

Link: CVE-2026-66357

cve-icon Redhat

No data.