A vulnerability known as HTTP Request Smuggling has been found in Erlang OTP's inets httpd module, a component used in some web server setups. The issue comes from a mismatch in how the module handles duplicate "Content-Length" headers, which signal the length of an incoming web request's body to a server. The affected module uses the first of these duplicate headers it receives, while common front-end reverse proxies (including nginx, Apache httpd, and Envoy, tools many websites use to manage incoming traffic) use the last header value. This breaks standard web request handling rules, and can let an attacker slip malicious, unapproved content into the stream of requests your site processes. This could be used to access restricted data or disrupt normal site operations. This issue affects Erlang OTP versions from 17.0 up to versions before 28.4.1, 27.3.4.9 and 26.2.5.18, as well as corresponding inets versions before 9.6.1, 9.3.2.3 and 9.1.0.5.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
