CVE-2026-73276 in OTP
Summary
by MITRE • 09/01/2026
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability described involves a critical flaw within the HTTP request parsing logic of the Erlang/OTP inets application, specifically affecting versions ranging from OTP 22.2 up to various patch levels across subsequent major releases including OTP 28 and OTP 29. The core issue stems from an implementation error where gracefulness code, intended to handle malformed or edge-case HTTP requests gracefully by rejecting them, fails to properly enforce rejection criteria for specific request formats. This oversight allows maliciously crafted HTTP requests that should logically be rejected by the server to instead be processed further down the pipeline. In high-performance web servers and reverse proxies, such as those built on Erlang/OTP, strict adherence to protocol specifications is essential not only for functional correctness but also for security integrity. When a server fails to reject invalid request structures, it creates an ambiguity in how subsequent requests are interpreted by upstream or downstream components.
This specific failure mode directly facilitates HTTP Request Smuggling attacks, a class of vulnerabilities that exploit discrepancies in how different network entities interpret the boundaries and content length of HTTP messages. In typical scenarios involving HTTP/1.1, servers rely on headers such as Content-Length and Transfer-Encoding to determine where one request ends and another begins. If an application server incorrectly processes or ignores malformed requests due to this gracefulness bug, it may misinterpret these delimiters. An attacker can craft a sequence of overlapping requests that appear valid to the client but are parsed differently by the intermediary proxy versus the backend server. This divergence allows the attacker to smuggle unauthorized requests through the infrastructure, potentially bypassing access controls, stealing session cookies, or injecting malicious content into responses viewed by other users. The impact is severe because it undermines the isolation between user sessions and can lead to cache poisoning if a caching layer is involved in the request path.
The affected software versions span multiple major releases of Erlang/OTP, indicating that this was not an isolated incident but rather a systemic issue present across several iterations until specific patches were applied. The vulnerability exists in OTP 22.2 through 27.3.4.17, OTP 28.0 through 28.5.0.6, and OTP 29.0 prior to version 29.0.6. Correspondingly, the underlying inets module is vulnerable from versions 7.1.2 up to 9.3.2.7, from 9.4 up to 9.6.2.3, and from 9.7 up to 9.7.2. This wide range of affected versions suggests that the flaw was introduced in an earlier release and persisted through subsequent updates until a comprehensive fix was implemented. Organizations running any of these specific version combinations are at risk unless they have applied the corresponding security patches or upgraded to a safe version outside the specified ranges.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately validate and reject malformed HTTP requests that violate protocol standards. Furthermore, it maps directly to MITRE ATT&CK technique T1537, which covers Communication via Distributed Component Object Model (DCOM) or more broadly in this context, techniques related to bypassing defenses through request smuggling. The specific tactic involves manipulating the interpretation of network traffic to evade security controls and inject malicious payloads. Security architects must recognize that HTTP Request Smuggling is not merely a functional bug but a significant attack vector for privilege escalation and data exfiltration.
To mitigate this risk, immediate action is required to upgrade the Erlang/OTP runtime environment to versions that include the fix for inets request parsing logic. For environments using OTP 27.x, version 27.3.4.17 or later should be deployed; for OTP 28.x, version 28.5.0.6 or later is required; and for OTP 29.x, version 29.0.6 or higher must be installed. Correspondingly, the inets module versions must also be updated to their respective secure counterparts as listed above. In addition to upgrading software, organizations should implement strict input validation at the network perimeter using Web Application Firewalls (WAFs) configured to detect and block anomalous HTTP request patterns associated with smuggling attacks. This includes monitoring for duplicate Content-Length headers, mismatched Transfer-Encoding values, or other indicators of malformed requests that deviate from RFC 7230 standards. Regular security audits and penetration testing focused on HTTP protocol compliance are also recommended to ensure no residual vulnerabilities remain in custom implementations or third-party integrations relying on the affected components.