CVE-2026-73276: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-73276 is an HTTP Request Smuggling vulnerability (CWE-444) in Erlang/OTP's inets httpd server, caused by improper handling of HTTP headers containing whitespace between the header field-name and the colon (e.g., Content-Length : 6). Instead of rejecting such malformed headers per RFC 7230 §3.2.4, the server silently dropped them, enabling a CL.0 desync attack when deployed behind a lenient reverse proxy. It affects OTP versions 22.2 through 27.3.4.17, 28.0 through 28.5.0.6, and 29.0 through 29.0.6, with corresponding inets versions 7.1.2–9.3.2.7, 9.4–9.6.2.3, and 9.7–9.7.2. The vulnerability was published on September 1, 2026, with a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Microsoft MSRC).

The root cause lies in the key_value/1 function in lib/inets/src/http_lib/http_request.erl, which previously returned undefined (causing the header to be silently dropped) when it detected trailing whitespace before the colon in a header field-name, rather than returning an error. This violates RFC 7230 §3.2.4, which mandates that servers reject such requests with a 400 Bad Request response. When a malformed Content-Length : 6 header is dropped, the server defaults the content length to 0 and reinterprets the actual request body bytes as the beginning of the next pipelined HTTP request via body_data/2 — a classic CL.0 desync pattern. Exploitation requires the victim httpd to be deployed behind a reverse proxy that tolerates whitespace before the colon and correctly extracts the Content-Length value, making real-world exploitation less common but plausible (GitHub Advisory, OTP Commit).

Successful exploitation allows an unauthenticated network attacker to smuggle HTTP requests to backend services, potentially poisoning shared caches, bypassing security controls (such as WAF rules or authentication checks enforced at the proxy layer), and manipulating requests forwarded to backend applications. The primary integrity impact is high, as smuggled requests can alter the behavior of backend systems or cause other users' requests to be hijacked. Confidentiality impact is limited (rated Low in CVSS v4), and there is no direct availability impact (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is approximately 0.33%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD SSVC assessment classifies it as non-automatable with partial technical impact. Exploitation requires a specific deployment configuration (httpd behind a lenient reverse proxy), further reducing practical risk (GitHub Advisory, Feedly).

1. Identify target: Locate an Erlang/OTP inets httpd instance running a vulnerable version (OTP 22.2–27.3.4.16, 28.0–28.5.0.5, or 29.0–29.0.5) deployed behind a reverse proxy that is lenient in parsing headers with whitespace before the colon.
2. Craft malformed request: Construct an HTTP request with a header containing whitespace before the colon, such as Content-Length : 6, along with a body of 6 bytes containing a smuggled HTTP request prefix (e.g., GET /admin HTTP/1.1\r\n).
3. Send via reverse proxy: Transmit the crafted request through the reverse proxy. The proxy correctly reads the Content-Length : 6 value and forwards the full 6-byte body to httpd.
4. Trigger CL.0 desync: The inets httpd silently drops the malformed Content-Length header, defaults content length to 0, and feeds the 6 body bytes into its request parser as the start of a new pipelined request.
5. Achieve smuggling objective: The injected request prefix is processed by httpd as a new request, potentially poisoning the response cache, bypassing access controls, or hijacking subsequent legitimate user requests (GitHub Advisory, OTP Commit).

• Network: HTTP requests to the inets httpd server containing headers with whitespace before the colon (e.g., Content-Length : <n>); unexpected pipelined requests arriving at the backend that do not correspond to proxy-forwarded client requests.
• Logs: HTTP access logs showing unexpected 400 Bad Request responses after patching (indicating attempted exploitation); unusual sequences of requests in httpd logs where a request body appears to be parsed as a new request line.
• Application Behavior: Unexpected cache poisoning artifacts (e.g., users receiving responses intended for other users); security controls being bypassed for requests that should have been blocked at the proxy layer.

Erlang/OTP has released patched versions that return a 400 Bad Request error for headers with whitespace before the colon, rather than silently dropping them. Users should upgrade to OTP 27.3.4.17 or later (27.x branch), 28.5.0.6 or later (28.x branch), or 29.0.6 or later (29.x branch), with corresponding inets versions 9.3.2.7, 9.6.2.3, or 9.7.2 respectively. As a workaround, configure the reverse proxy to reject or normalize requests with whitespace between header names and the colon before forwarding, or deploy httpd without a reverse proxy in front (GitHub Advisory, OTP Commit).

The vulnerability was included in Microsoft's September 2026 Patch Tuesday coverage, which addressed 966 flaws including 2 zero-days, indicating broad industry awareness of the release cycle. No significant independent researcher commentary or social media discussion specific to this CVE has been identified beyond standard vulnerability database aggregation.