A security flaw tracked as CVE-2026-23941, known as HTTP Request Smuggling, has been identified in the inets httpd web server module, a component of the Erlang OTP software used by some hosting environments to handle web traffic. The flaw stems from how the server processes duplicate Content-Length headers in incoming web requests. The server uses the first Content-Length value it receives to parse request data, while most common intermediary servers (called reverse proxies, including nginx, Apache httpd, and Envoy) use the last Content-Length value. This mismatch breaks the expected flow of traffic between front-end and back-end servers, allowing an attacker to embed extra malicious request data that gets mistaken for the start of a separate, legitimate next request. This issue affects Erlang OTP versions from 17.0 up to (but not including) OTP 28.4.1, 27.3.4.9, and 26.2.5.18, along with corresponding inets versions before 9.6.1, 9.3.2.3, and 9.1.0.5.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
