A security flaw has been found in the inets httpd web server module included with Erlang OTP, a software platform some websites use to process web traffic. The issue is classified as HTTP request smuggling, a type of vulnerability that can let attackers sneak unauthorized commands or data into legitimate visitor traffic to bypass a website's normal security checks. The flaw exists because the server does not reject or normalize duplicate Content-Length headers, which are standard parts of web requests that tell the server how much data a request contains. This server component uses the first of these duplicate headers to parse request body data, while most common front-end web tools (including nginx, Apache httpd, and Envoy) use the last one. This mismatch violates official web request standards and creates a gap that allows attacker-controlled content to be queued as the start of a legitimate next request, bypassing normal security safeguards. The vulnerability
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
