CVE-2026-73812

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73812
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73812.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73812
Aliases
Downstream
Published
2026-09-01T14:42:42.374Z
Modified
2026-09-03T03:48:19.853452575Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
Details

httpd function checkheader/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73812.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "17.0"
                },
                {
                    "fixed": "27.3.4.17"
                },
                {
                    "introduced": "28.0"
                },
                {
                    "fixed": "28.5.0.6"
                },
                {
                    "introduced": "29.0"
                },
                {
                    "fixed": "29.0.6"
                },
                {
                    "introduced": "5.10"
                },
                {
                    "fixed": "9.3.2.7"
                },
                {
                    "introduced": "9.4"
                },
                {
                    "fixed": "9.6.2.3"
                },
                {
                    "introduced": "9.7"
                },
                {
                    "fixed": "9.7.2"
                },
                {
                    "introduced": "84adefa331c4159d432d22840663c38f155cd4c1"
                },
                {
                    "fixed": "591dc00dc99dc2a426167a3b5257c0c94bd45e91"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "fixed": "27.3.4.17"
                },
                {
                    "introduced": "28.0"
                },
                {
                    "fixed": "28.5.0.6"
                },
                {
                    "introduced": "29.0"
                },
                {
                    "fixed": "29.0.6"
                }
            ]
        },
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "17.0"
                },
                {
                    "introduced": "28.0"
                },
                {
                    "introduced": "29.0"
                },
                {
                    "introduced": "5.10"
                },
                {
                    "fixed": "9.3.2.7"
                },
                {
                    "introduced": "9.4"
                },
                {
                    "fixed": "9.6.2.3"
                },
                {
                    "introduced": "9.7"
                },
                {
                    "fixed": "9.7.2"
                },
                {
                    "fixed": "5.10"
                }
            ]
        }
    ],
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-444"
    ]
}
References

Affected packages

Git / github.com/erlang/otp

Affected ranges

Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
591dc00dc99dc2a426167a3b5257c0c94bd45e91
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

OTP-17.*
OTP-17.0
OTP-18.*
OTP-18.0
OTP-18.0-rc1
OTP-19.*
OTP-19.0
OTP-19.0-rc1
OTP-19.0-rc2
OTP-20.*
OTP-20.0
OTP-20.0-rc1
OTP-20.0-rc2
OTP-21.*
OTP-21.0
OTP-21.0-rc1
OTP-21.0-rc2
OTP-22.*
OTP-22.0
OTP-22.0-rc1
OTP-22.0-rc2
OTP-22.0-rc3
OTP-23.*
OTP-23.0
OTP-23.0-rc1
OTP-23.0-rc2
OTP-23.0-rc3
OTP-24.*
OTP-24.0
OTP-24.0-rc1
OTP-24.0-rc2
OTP-24.0-rc3
OTP-25.*
OTP-25.0
OTP-25.0-rc1
OTP-25.0-rc2
OTP-25.0-rc3
OTP-26.*
OTP-26.0
OTP-26.0-rc1
OTP-26.0-rc2
OTP-26.0-rc3
OTP-27.*
OTP-27.0
OTP-27.0-rc1
OTP-27.0-rc2
OTP-27.0-rc3
OTP-27.1
OTP-27.2
OTP-27.3
OTP-27.3.1
OTP-27.3.2
OTP-27.3.3
OTP_17.*
OTP_17.0-rc1
OTP_17.0-rc2
Other
OTP_R13B03
OTP_R13B04
OTP_R14A
OTP_R14B
OTP_R14B01
OTP_R14B02
OTP_R14B03
OTP_R15A
OTP_R15B
OTP_R16A_RELEASE_CANDIDATE
OTP_R16B

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73812.json"