CVE-2026-73812

Name of the Vulnerable Software and Affected Versions OTP versions 17.0 through 27.3.4.16 OTP versions 28.0 through 28.5.0.5 OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1

Description The check header/3 function in httpd fails to check for the simultaneous presence of Transfer-Encoding (TE) and Content-Length (CL) headers, a condition identified by RFC 9112 §6.3 as a probable request smuggling attempt. Additionally, the handle body/3 function processes requests as chunked and silently discards the Content-Length header. This behavior can lead to a CL.TE front-end/back-end desynchronization when a front-end that prefers Content-Length is paired with an inets back-end that prefers chunked encoding.

Recommendations Update OTP to version 27.3.4.17 or later. Update OTP to version 28.5.0.6 or later. Update OTP to version 29.0.6 or later. Update inets to version 9.3.2.7 or later. Update inets to version 9.6.2.3 or later. Update inets to version 9.7.2 or later.