A security flaw called HTTP Request Smuggling has been identified in the inets HTTP server module included with Erlang OTP. This issue occurs because the affected server software does not properly handle duplicate Content-Length headers in incoming web requests: it uses the first listed Content-Length value to parse request data, while common front-end proxy servers (including nginx, Apache httpd, and Envoy) use the last listed value. This behavior violates standard web request rules defined in RFC 9112 Section 6.3.
This mismatch creates a desynchronization between front-end proxy servers and the back-end inets server, allowing attackers to sneak extra, attacker-controlled data into the server's request queue. That extra data can be interpreted as the start of a legitimate follow-up request, which may let attackers perform unauthorized actions on affected websites, such as accessing restricted content, manipulating site functionality, or targeting other site visitors.
This flaw impacts Erlang OTP versions 17.0 up to (but not including) OTP 28.4.1, OTP 27.3.4.9, and OTP 26.2.5.18, along with corresponding inets versions 5.10 up to (but not including)
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
