CVE-2026-23941: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-23941 is an HTTP Request Smuggling vulnerability (CWE-444) in the Erlang OTP inets httpd module, caused by inconsistent handling of duplicate Content-Length headers. The server uses the first Content-Length value for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last value, enabling front-end/back-end desynchronization. It affects Erlang/OTP from version 17.0 up to (but not including) 26.2.5.18, 27.3.4.9, and 28.4.1, corresponding to inets versions 5.10 through 9.6.1, 9.3.2.3, and 9.1.0.5. The vulnerability was disclosed on March 13, 2026, with a CVSS v3.1 base score of 9.4 (Critical) and a CVSS v4.0 base score of 7.0 (High) (GitHub Advisory, Microsoft MSRC).

The root cause lies in the httpd_request:parse_headers/7 function within lib/inets/src/http_server/httpd_request.erl, which fails to reject or normalize requests containing multiple Content-Length headers with differing values — a violation of RFC 9112 Section 6.3. The vulnerable check_header/2 function accepted the first Content-Length value without verifying consistency across all occurrences; the fix introduces check_parsed_content_length_values/2 to compare all Content-Length values and return a 400 Bad Request if they differ (GitHub Commit). Exploitation requires the httpd server to be deployed behind a reverse proxy that applies a "last-wins" Content-Length resolution strategy (e.g., nginx, Apache httpd, Envoy), with HTTP persistent connections (keep-alive) enabled. An unauthenticated attacker can craft a request with two differing Content-Length headers, causing the proxy and backend to disagree on request boundaries, leaving attacker-controlled bytes queued as the start of the next request (GitHub Advisory).

Successful exploitation enables HTTP request smuggling attacks that can lead to authentication bypass (smuggled requests bypass proxy-layer authentication to access protected backend resources), cache poisoning (malicious content injected by desynchronizing request/response boundaries), and request hijacking (attacker-controlled bytes prepended to legitimate user requests on persistent connections). The primary impact is on subsequent/downstream systems — confidentiality and integrity of those systems are rated High, while availability impact is Low. This vulnerability does not affect standalone httpd deployments without a frontend proxy (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.016%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires specific deployment conditions — namely, httpd behind a reverse proxy with differing Content-Length resolution behavior and keep-alive enabled — which limits the attack surface compared to fully unauthenticated, standalone vulnerabilities (GitHub Advisory).

1. Reconnaissance: Identify targets running Erlang/OTP httpd (inets) behind a reverse proxy (nginx, Apache httpd, or Envoy) with HTTP keep-alive enabled, using service fingerprinting tools such as Shodan or Censys.
2. Confirm proxy behavior: Determine whether the frontend proxy uses a "last-wins" Content-Length resolution strategy (common in nginx and Envoy defaults), which differs from httpd's "first-wins" behavior.
3. Craft smuggling request: Construct an HTTP request with two conflicting Content-Length headers — e.g., Content-Length: 0\r\nContent-Length: 44\r\n — where the first value causes httpd to treat the body as empty, while the proxy forwards based on the second value.
4. Inject smuggled prefix: The bytes following the first request boundary (as interpreted by httpd) are queued as the beginning of the next request. Craft these bytes to form a partial HTTP request targeting a protected endpoint (e.g., an admin API).
5. Trigger victim request: Wait for or induce a legitimate user request on the same persistent connection; the smuggled prefix is prepended to their request, potentially hijacking their session, bypassing authentication, or poisoning shared caches (GitHub Advisory).

• Network: HTTP requests to the Erlang httpd server containing multiple Content-Length headers with differing values; unusual sequences of requests on persistent connections where request boundaries appear misaligned.
• Logs: Erlang httpd access logs showing 400 Bad Request responses (on patched systems) for POST requests with duplicate Content-Length headers; unexpected requests to protected endpoints originating from the reverse proxy's IP rather than the actual client.
• Application Behavior: Authenticated endpoints being accessed without valid session tokens; cache entries containing unexpected or malicious content; users reporting unexpected actions performed under their session.

Upgrade Erlang/OTP to one of the patched versions: 26.2.5.18, 27.3.4.9, or 28.4.1; for the inets module specifically, upgrade to 9.1.0.5, 9.3.2.3, or 9.6.1 depending on the installed branch (GitHub Advisory, Erlang Forums OTP 28.4.1). If immediate upgrade is not possible, configure the frontend reverse proxy to reject requests with duplicate or conflicting Content-Length headers. Additional workarounds include disabling HTTP keep-alive on httpd by adding {keep_alive, false} to the httpd configuration (note: this impacts performance), or deploying a WAF rule to block requests with multiple Content-Length headers (GitHub Advisory). IBM has also published security bulletins for affected products including PowerVC (IBM Bulletin).

The vulnerability was responsibly disclosed by researcher Luigino Camastra (LuiginoC) to the Erlang/OTP project, which published a GitHub Security Advisory and released coordinated patches across three active OTP branches (GitHub Advisory). Patch announcements were posted to both Erlang Forums and Elixir Forum, generating community discussion around the deployment conditions required for exploitation. IBM issued security bulletins for affected downstream products, and SUSE and Debian published security updates incorporating the fix (IBM Bulletin, SUSE Advisory). The CVE was also noted by the @CVEnew Twitter/X account, contributing to broader awareness in the security community.