CVE-2026-73812: 
Erlang OTP vulnerability analysis and mitigation

CVE-2026-73812 is an HTTP Request Smuggling vulnerability (CWE-444) in the Erlang/OTP inets HTTP server (httpd) that allows unauthenticated remote attackers to desynchronize front-end/back-end request framing via the co-presence of Transfer-Encoding: chunked and Content-Length headers. The check_header/3 function rejects duplicate Content-Length headers (per CVE-2026-23941) but fails to detect the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt; handle_body/3 frames by chunked encoding and silently discards Content-Length. Affected versions span OTP 17.0 through 27.3.4.17, OTP 28.0 through 28.5.0.6, and OTP 29.0 through 29.0.6 (corresponding to inets 5.10–9.3.2.7, 9.4–9.6.2.3, and 9.7–9.7.2); versions prior to OTP 17.0 have unknown status. It was published on September 1, 2026, with a CVSS v3.1 base score of 8.2 (High) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). The httpd_request.erl check_header/3 function validates headers individually but never cross-checks for the simultaneous presence of both Transfer-Encoding and Content-Length headers in the same request, violating RFC 9112 §6.3. When httpd is deployed behind a reverse proxy that prefers Content-Length to determine message boundaries (CL-preferring front-end), while httpd itself frames by chunked encoding (TE-preferring back-end), an attacker can craft a request where the proxy and httpd disagree on where the request body ends — a classic CL.TE desync. The fix (commit 591dc00) modifies check_header to accept a Headers accumulator argument and immediately return {error, {bad_request, 400, ...}} if either transfer-encoding is seen when content-length is already present, or vice versa (GitHub Advisory, Fix Commit). Additionally, httpd violates the RFC MUST requirement to close the connection after responding to such a request, compounding the risk (GitHub Advisory).

Successful exploitation enables an attacker to smuggle a second HTTP request inside the body of the first, which httpd interprets as a new pipelined request. This can allow injection of requests that bypass the reverse proxy's access controls, poisoning of responses intended for other users sharing the same connection, and bypassing of authentication enforced at the proxy layer. The vulnerability has high integrity impact and low confidentiality impact, with no direct availability impact; however, the ability to bypass authentication and poison shared connections represents a significant risk in multi-tenant or shared-infrastructure deployments (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.003 (0.3%), reflecting low near-term exploitation probability. Exploitation requires a specific deployment configuration — httpd must be placed behind a CL-preferring reverse proxy — which limits the attack surface compared to direct-exposure scenarios (GitHub Advisory). No threat actor attribution has been reported.

1. Reconnaissance: Identify services running Erlang/OTP inets httpd (OTP 17.0–27.3.4.17, 28.0–28.5.0.6, or 29.0–29.0.6) deployed behind a reverse proxy that prefers Content-Length over Transfer-Encoding (e.g., certain configurations of nginx, HAProxy, or AWS ALB).
2. Craft the smuggling request: Construct an HTTP request containing both Transfer-Encoding: chunked and a Content-Length header. The Content-Length value is set to encompass only part of the chunked body, while the remainder constitutes the smuggled request prefix.

   POST /target HTTP/1.1
   Host: victim.example.com
   Transfer-Encoding: chunked
   Content-Length: 6
   
   0
   
   GET /admin HTTP/1.1
   Host: victim.example.com

3. Front-end processing: The CL-preferring reverse proxy reads exactly Content-Length bytes (e.g., 6) as the body and forwards the request, treating the remainder as the start of the next request.
4. Back-end processing: httpd frames by chunked encoding, reads the 0\r\n\r\n chunk terminator as the end of the first request body, and then interprets the remaining bytes (GET /admin HTTP/1.1\r\n...) as a new pipelined request — bypassing any proxy-level access controls applied to the original request.
5. Achieve objective: The smuggled request is processed by httpd with the identity/context of the connection, potentially accessing restricted endpoints, poisoning cached responses for subsequent users, or bypassing authentication (GitHub Advisory).

• Network: HTTP requests to httpd-backed endpoints containing both Transfer-Encoding: chunked and Content-Length headers simultaneously; unexpected or anomalous pipelined requests arriving at the back-end server that do not correspond to requests logged at the front-end proxy.
• Logs: After patching, httpd access logs will show 400 Bad Request responses with the message "Transfer-Encoding and Content-Length headers in the same request are forbidden" for exploitation attempts; discrepancies between front-end proxy access logs and httpd request logs (e.g., extra requests appearing in httpd logs with no corresponding front-end entry).
• Application Behavior: Unexpected access to restricted or administrative endpoints without corresponding authentication events at the proxy layer; users receiving responses intended for other users (session/response poisoning symptoms) (GitHub Advisory, Fix Commit).

Upgrade Erlang/OTP to a patched version: OTP 27.3.4.17 or later, OTP 28.5.0.6 or later, or OTP 29.0.6 or later (corresponding inets versions: 9.3.2.7, 9.6.2.3, or 9.7.2). The fix causes httpd to reject any request containing both Transfer-Encoding and Content-Length with a 400 Bad Request response. If immediate upgrade is not possible, the following workarounds reduce risk: (1) deploy httpd without a reverse proxy in front, eliminating the desync vector; (2) configure the reverse proxy to reject or drop requests containing both Transfer-Encoding and Content-Length headers before forwarding; (3) configure the reverse proxy to normalize requests by stripping Content-Length when Transfer-Encoding: chunked is present; (4) deploy WAF rules to detect and block HTTP smuggling patterns (GitHub Advisory, Microsoft Advisory).

The vulnerability was assigned by the Erlang Ecosystem Foundation (EEF) and published via a GitHub Security Advisory on September 1, 2026, credited to researchers garazdawi and Whaileee. Microsoft included it in their September 2026 Patch Tuesday advisory cycle, noting its impact on the Azure Linux 3 Erlang package (BleepingComputer). Red Hat also published a CVE advisory. No significant independent researcher commentary or social media discussion beyond standard vulnerability tracking has been observed.