High severity · published Sep 1, 2026
CVE-2026-73276
inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
8.3
CVSS
0.6%
EPSS
No
On KEV
Description
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OT
OTP · Erlang
22.2 before 27.3.4.17; 28.0 before 28.5.0.6; 29.0 before 29.0.6; 7.1.2 before 9.3.2.7; 9.4 before 9.6.2.3; 9.7 before 9.7.2; +1 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73276
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73276
cna.erlef.org
https://cna.erlef.org/cves/CVE-2026-73276.html
github.com
https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683
github.com
https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c
github.com
https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f
github.com
https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p
osv.dev
https://osv.dev/vulnerability/EEF-CVE-2026-73276
More from OTP
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
9.8
CVE-2026-28808
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)
9.8
CVE-2022-37026
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and…
9.8
CVE-2016-10253
An issue was discovered in Erlang/OTP 18.x
9.4
CVE-2026-23941
Request smuggling via first-wins Content-Length parsing in inets httpd