A security vulnerability called HTTP request smuggling has been found in the web server component of Erlang OTP, a software framework used in some web hosting setups. The flaw stems from how the server handles duplicate Content-Length headers, which are standard parts of web requests that tell the server how large the request's data is. The server uses the first Content-Length value it receives, while most common front-end proxy tools (including nginx, Apache httpd, and Envoy) use the last value. This mismatch can let attackers slip unauthorized, attacker-controlled data into web requests that gets treated as the start of a separate, legitimate user request, which could be used to exploit other systems or access restricted data. This issue affects Erlang OTP versions from 17.0 up to (but not including) OTP 28.4.1, OTP 27.3.4.9, and OTP 26.2.5.18, along with matching versions of the inets web module.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
