A vulnerability tracked as CVE-2026-23941, known as an HTTP Request Smuggling flaw, exists in the Erlang OTP inets httpd module, a component used in some web server setups. This issue violates official web request processing standards (RFC 9112) that are designed to keep web traffic consistent and secure.
The flaw stems from how the module handles duplicate Content-Length headers, which are used to tell a server how much data to expect in a web request. This component uses the first of these duplicate headers to parse request data, while common reverse proxies (including nginx, Apache httpd, and Envoy) use the last one. This mismatch can let attackers inject unauthorized, attacker-controlled content into your server's request queue, which could be used to access restricted data, disrupt legitimate user traffic, or carry out other malicious actions against your website.
This issue affects Erlang OTP versions from 17.0 up to versions before 28.4.1, 27.3.4.9, and 26.2.5.18, as well as corresponding inets versions before 9.6.1, 9.3.2.3, and 9.1.0.5.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
