httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Metrics
Affected Vendors & Products
References
History
Tue, 01 Sep 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Erlang erlang/otp
Erlang otp |
|
| Vendors & Products |
Erlang erlang/otp
Erlang otp |
|
| Metrics |
ssvc
|
Tue, 01 Sep 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown. | |
| Title | inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length | |
| First Time appeared |
Erlang
Erlang erlang\/otp |
|
| Weaknesses | CWE-444 | |
| CPEs | cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Erlang
Erlang erlang\/otp |
|
| References |
| |
| Metrics |
cvssV4_0
|
Status: PUBLISHED
Assigner: EEF
Published: 2026-09-01T14:42:42.374Z
Updated: 2026-09-01T15:56:45.383Z
Reserved: 2026-08-17T11:00:01.498Z
Link: CVE-2026-73812
Updated: 2026-09-01T15:56:35.712Z
Status : Deferred
Published: 2026-09-01T15:17:25.540
Modified: 2026-09-01T21:15:00.147
Link: CVE-2026-73812
No data.