A security flaw has been found in the Erlang OTP software's built-in inets httpd web server module, categorized as an HTTP Request Smuggling vulnerability. This issue stems from how the server handles duplicate Content-Length headers (the part of a web request that tells the server how large the request's data is) that are sometimes included in incoming traffic to your site. The affected server uses the first duplicate Content-Length header it receives to calculate the size of the request's data, while most common front-end proxy servers (including nginx, Apache httpd, and Envoy, which are often used to route traffic to websites) use the last duplicate header value. This mismatch violates
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2026-23941
