CVE-2026-66835

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5

Description A path equivalence issue in the inets httpd allows a remote unauthenticated attacker to read files within a directory protected by mod auth by adding an extra slash to the request path. The function httpd request:validate uri/1 uses uri string:normalize/1 for normalization, which removes dot-segments according to RFC 3986 but fails to collapse empty path segments, allowing doubled slashes to persist. Subsequently, mod alias:real name/3 concatenates the document root with the URI, and mod auth:secret path/3 checks if the result is within a protected block using an unanchored regular expression. The doubled slash disrupts the expected substring, causing the request to be treated as unprotected and bypassing the authentication challenge. However, the operating system collapses the doubled slash when mod get opens the path, granting access to the protected file. This mismatch also allows the attacker to evade per-path accounting in mod security. This issue only affects servers that use mod auth to protect directories with authentication requirements.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later.