A security flaw called HTTP Request Smuggling has been found in the Erlang inets httpd module, a component that runs on some web servers. The problem happens because the module doesn't handle duplicate Content-Length headers in incoming website requests correctly: it uses the first header it sees to read request data, while common front-end servers like nginx, Apache httpd, and Envoy use the last header value. This breaks standard web request rules, and can let attackers sneak harmful or unauthorized requests past your website's security filters, with their own malicious data queued as the start of the next legitimate site request. This issue affects Erlang OTP versions from 17.0 up to versions older than 28.4.1, 27.3.4.9, and 26.2.5.18, along with matching inets module versions from 5.10 up to versions older than 9.6.1, 9.3.2.3, and 9.1.0.5.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
