CVE-2026-66357

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1

Description httpd does not implement obs-fold, a feature regarding header continuation lines. Consequently, every Carriage Return Line Feed (CRLF) followed by a non-CRLF octet is unconditionally treated as the start of a new header. This lack of implementation creates a risk for HTTP request smuggling attacks, where an attacker can interfere with the way a website processes sequences of HTTP requests.

Recommendations Update OTP to version 27.3.4.17 or later. Update OTP to version 28.5.0.6 or later. Update OTP to version 29.0.6 or later. Update inets to version 9.3.2.7 or later. Update inets to version 9.6.2.3 or later. Update inets to version 9.7.2 or later.