PT-2026-84265
CVE-2026-73276
·
Published
2026-09-01
·
Updated
2026-09-30
Description by
CVSS 4.0
8.3
HighMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OTP versions 22.2 through 27.3.4.16
OTP versions 28.0 through 28.5.0.5
OTP versions 29.0 through 29.0.5
inets versions 7.1.2 through 9.3.2.6
inets versions 9.4 through 9.6.2.2
inets versions 9.7 through 9.7.1
Description
Gracefulness code ignored cases that should be rejected, which creates opportunities for HTTP Request Smuggling. This occurs when the server and a proxy disagree on the boundaries of a request, allowing an attacker to smuggle a hidden request to the backend server.
Recommendations
Update OTP to version 27.3.4.17 or later.
Update OTP to version 28.5.0.6 or later.
Update OTP to version 29.0.6 or later.
Update inets to version 9.3.2.7 or later.
Update inets to version 9.6.2.3 or later.
Update inets to version 9.7.2 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾