Login Request a demo
Critical severity · published Mar 13, 2026
CVE-2026-23941
Request smuggling via first-wins Content-Length parsing in inets httpd
9.4
CVSS
0.5%
EPSS
No
On KEV
Description
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OT
OTP · Erlang
5.10; 17.0; 84adefa331c4159d432d22840663c38f155cd4c1 · source: vendor
ER
Erlang/inets · Erlang
5.10 before 9.1.0.5; 9.3 before 9.3.2.3; 9.6 before 9.6.1 · source: NVD
ER
Erlang/otp · Erlang
17.0 before 26.2.5.18; 27.0 before 27.3.4.9; 28.0 before 28.4.1 · source: NVD
Affected product
OT
OTP
Erlang
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23941
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23941
Vendor Advisory
https://cna.erlef.org/cves/CVE-2026-23941.html
Patch
https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18
Patch
https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b
Patch
https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6
Vendor Advisory
https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7
Third Party Advisory
https://osv.dev/vulnerability/EEF-CVE-2026-23941
More from OTP
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
9.8
CVE-2026-28808
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
9.8
CVE-2022-37026
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and…
9.8
CVE-2016-10253
An issue was discovered in Erlang/OTP 18.x
9.3
CVE-2026-89422
TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension