A security vulnerability known as HTTP request smuggling has been identified in the Erlang OTP inets httpd module, a component used to run web servers. This flaw stems from how the server handles duplicate "Content-Length" headers, which specify the size of data included in a web request: the server uses the first header of this type it receives, while common front-end proxies including nginx, Apache httpd, and Envoy use the last matching header. This mismatch lets attackers sneak extra, malicious data into requests that gets processed as the start of a separate valid request, creating risks including unauthorized access to sensitive data, unapproved actions taken on your website, or disruption to your site's normal operation.
This issue impacts Erlang OTP versions from 17.0 up to (but not including) OTP 28.4.1, 27.3.4.9, and 26.2.5.18, along with corresponding inets web server versions older than 9.6.1, 9.3.2.3, and 9.1.0.5. The flaw violates official web request standards (RFC 9112 Section 6.3) and creates a desynchronization between front-end proxies and back-end web servers that attackers can exploit to carry out malicious activity.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
