A security flaw tracked as CVE-2026-23941 has been identified in the Erlang OTP inets httpd module, a component commonly used to serve websites, that enables a type of attack known as HTTP request smuggling. This flaw stems from how the server handles duplicate Content-Length headers in incoming web requests: it uses the first instance of the header to parse request body data, while common front-end reverse proxies (including nginx, Apache httpd, and Envoy) use the last instance. This mismatch violates official web request standards and can create a desynchronization gap between front-end and back-end server processing.
When exploited, this gap can let attackers slip unvetted, attacker-controlled data into the server's request queue. This data may be treated as the start of a new legitimate request, which could allow attackers to hijack user sessions, access restricted areas of your website, or interfere with other sites hosted on the same server infrastructure.
This vulnerability impacts Erlang OTP versions from 17.0 up to (but not including) OTP 28.4.1, OTP 27.3.4.9, and OTP 26.2.5.18, as well as corresponding inets versions earlier than 9.6.1, 9.3.2.3, and 9.1.0.5.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
