A security flaw called HTTP Request Smuggling has been found in the Erlang OTP inets httpd module, a component used to run web services. This vulnerability creates a mismatch in how web requests are interpreted that attackers could exploit to interfere with your website's normal operations. The issue occurs because the affected software does not reject or properly handle duplicate Content-Length headers, which are standard parts of web requests that tell a server how much data the request includes. The affected software uses the first Content-Length header it encounters, while most common front-end web servers (including nginx, Apache httpd, and Envoy) use the last one. This violates official web request standards and creates a gap that can let attackers sneak unapproved, attacker-controlled content into requests your website processes. This could be used to steal user data, hijack user accounts, or run other harmful actions on your site. This vulnerability impacts Erlang OTP versions from 17.0 up to (but not including) 28.4.1, 27.3.4.9, and 26.2.5.18, along with corresponding inets module versions from 5.10 up to (but not including) 9.6.1, 9.3.2.3, and 9.1.0.5.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
