CVE-2026-23941

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23941", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-01-19T14:23:14.343Z", "datePublished": "2026-03-13T09:11:58.175Z", "dateUpdated": "2026-11-11T19:45:01.134Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["httpd_request"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/inets/src/http_server/httpd_request.erl"], "programRoutines": [{"name": "httpd_request:parse_headers/7"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "26.2.5.18", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "28.4.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["httpd_request"], "packageName": "inets", "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/http_server/httpd_request.erl"], "programRoutines": [{"name": "httpd_request:parse_headers/7"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "9.1.0.5", "status": "unaffected"}, {"at": "9.3.2.3", "status": "unaffected"}, {"at": "9.6.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["httpd_request"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/inets/src/http_server/httpd_request.erl"], "programRoutines": [{"name": "httpd_request:parse_headers/7"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "e775a332f623851385ab6ddb866d9b150612ddf6", "status": "unaffected"}, {"at": "a761d391d8d08316cbd7d4a86733ba932b73c45b", "status": "unaffected"}, {"at": "a4b46336fd25aa100ac602eb9a627aaead7eda18", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "e775a332f623851385ab6ddb866d9b150612ddf6", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "a761d391d8d08316cbd7d4a86733ba932b73c45b", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "a4b46336fd25aa100ac602eb9a627aaead7eda18", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default).</p>"}, {"base64": false, "type": "text/markdown", "value": "The inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default)."}], "value": "The inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default)."}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "26.2.5.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "finder", "value": "Luigino Camastra / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak"}], "datePublic": "2026-03-13T09:11:58.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.</p>\n<p>This vulnerability is associated with program files <code>lib/inets/src/http_server/httpd_request.erl</code> and program routines <code>httpd_request:parse_headers/7</code>.</p>\n<p>The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.18, OTP&nbsp;27.3.4.9, and OTP&nbsp;28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>"}, {"base64": false, "type": "text/markdown", "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files `lib/inets/src/http_server/httpd_request.erl` and program routines `httpd_request:parse_headers/7`.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}], "impacts": [{"capecId": "CAPEC-33", "descriptions": [{"lang": "en", "value": "CAPEC-33 HTTP Request Smuggling"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:45:01.134Z"}, "references": [{"name": "Request smuggling via first-wins Content-Length parsing in inets httpd", "tags": ["vendor-advisory", "related"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7"}, {"name": "EEF CNA record for CVE-2026-23941", "tags": ["related"], "url": "https://cna.erlef.org/cves/CVE-2026-23941.html"}, {"name": "OSV record EEF-CVE-2026-23941", "tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-23941"}, {"name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}, {"name": "Fix commit e775a33 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6"}, {"name": "Fix commit a761d39 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b"}, {"name": "Fix commit a4b4633 in erlang/otp", "tags": ["patch"], "url": "https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18"}], "source": {"discovery": "EXTERNAL"}, "title": "Request smuggling via first-wins Content-Length parsing in inets httpd", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<ul>\n<li>Configure frontend proxy to reject requests with duplicate Content-Length headers.</li>\n<li>Disable HTTP keep-alive on httpd by adding <code>{keep_alive, false}</code> to httpd configuration. Note: This impacts performance for clients making multiple requests.</li>\n<li>Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers.</li>\n</ul>"}, {"base64": false, "type": "text/markdown", "value": "* Configure frontend proxy to reject requests with duplicate Content-Length headers.\n* Disable HTTP keep-alive on httpd by adding `{keep_alive, false}` to httpd configuration. Note: This impacts performance for clients making multiple requests.\n* Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers."}], "value": "* Configure frontend proxy to reject requests with duplicate Content-Length headers.\n* Disable HTTP keep-alive on httpd by adding {keep_alive, false} to httpd configuration. Note: This impacts performance for clients making multiple requests.\n* Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T16:00:50.466386Z", "id": "CVE-2026-23941", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:00:56.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23941", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T16:00:50.466386Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T16:00:52.958Z"}}], "cna": {"title": "Request smuggling via first-wins Content-Length parsing in inets httpd", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Luigino Camastra / Aisle Research"}, {"lang": "en", "type": "remediation developer", "value": "Konrad Pietrzak"}], "impacts": [{"capecId": "CAPEC-33", "descriptions": [{"lang": "en", "value": "CAPEC-33 HTTP Request Smuggling"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "vendor": "Erlang", "modules": ["httpd_request"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "26.2.5.18", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "28.4.1", "status": "unaffected"}], "version": "17.0", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:software-id/erlang.org/otp", "packageName": "otp", "programFiles": ["lib/inets/src/http_server/httpd_request.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "httpd_request:parse_headers/7"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["httpd_request"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "9.1.0.5", "status": "unaffected"}, {"at": "9.3.2.3", "status": "unaffected"}, {"at": "9.6.1", "status": "unaffected"}], "version": "5.10", "lessThan": "*", "versionType": "otp"}], "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "packageName": "inets", "programFiles": ["src/http_server/httpd_request.erl"], "defaultStatus": "unknown", "programRoutines": [{"name": "httpd_request:parse_headers/7"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "modules": ["httpd_request"], "product": "OTP", "versions": [{"status": "affected", "changes": [{"at": "e775a332f623851385ab6ddb866d9b150612ddf6", "status": "unaffected"}, {"at": "a761d391d8d08316cbd7d4a86733ba932b73c45b", "status": "unaffected"}, {"at": "a4b46336fd25aa100ac602eb9a627aaead7eda18", "status": "unaffected"}], "version": "84adefa331c4159d432d22840663c38f155cd4c1", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "e775a332f623851385ab6ddb866d9b150612ddf6", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "a761d391d8d08316cbd7d4a86733ba932b73c45b", "lessThan": "*", "versionType": "git"}, {"status": "unaffected", "version": "a4b46336fd25aa100ac602eb9a627aaead7eda18", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/erlang/otp", "packageName": "erlang/otp", "programFiles": ["lib/inets/src/http_server/httpd_request.erl"], "collectionURL": "https://github.com", "defaultStatus": "unknown", "programRoutines": [{"name": "httpd_request:parse_headers/7"}]}], "datePublic": "2026-03-13T09:11:58.000Z", "references": [{"url": "https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7", "name": "Request smuggling via first-wins Content-Length parsing in inets httpd", "tags": ["vendor-advisory", "related"]}, {"url": "https://cna.erlef.org/cves/CVE-2026-23941.html", "name": "EEF CNA record for CVE-2026-23941", "tags": ["related"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-23941", "name": "OSV record EEF-CVE-2026-23941", "tags": ["related"]}, {"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions", "name": "Erlang/OTP version ordering", "tags": ["x_version-scheme"]}, {"url": "https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6", "name": "Fix commit e775a33 in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b", "name": "Fix commit a761d39 in erlang/otp", "tags": ["patch"]}, {"url": "https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18", "name": "Fix commit a4b4633 in erlang/otp", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "* Configure frontend proxy to reject requests with duplicate Content-Length headers.\n* Disable HTTP keep-alive on httpd by adding {keep_alive, false} to httpd configuration. Note: This impacts performance for clients making multiple requests.\n* Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers.", "supportingMedia": [{"type": "text/html", "value": "<ul>\n<li>Configure frontend proxy to reject requests with duplicate Content-Length headers.</li>\n<li>Disable HTTP keep-alive on httpd by adding <code>{keep_alive, false}</code> to httpd configuration. Note: This impacts performance for clients making multiple requests.</li>\n<li>Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers.</li>\n</ul>", "base64": false}, {"type": "text/markdown", "value": "* Configure frontend proxy to reject requests with duplicate Content-Length headers.\n* Disable HTTP keep-alive on httpd by adding `{keep_alive, false}` to httpd configuration. Note: This impacts performance for clients making multiple requests.\n* Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers.", "base64": false}]}], "descriptions": [{"lang": "en", "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "supportingMedia": [{"type": "text/html", "value": "<p>Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.</p>\n<p>This vulnerability is associated with program files <code>lib/inets/src/http_server/httpd_request.erl</code> and program routines <code>httpd_request:parse_headers/7</code>.</p>\n<p>The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.</p>\n<p>This issue affects OTP from OTP&nbsp;17.0 before OTP&nbsp;26.2.5.18, OTP&nbsp;27.3.4.9, and OTP&nbsp;28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP&nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.</p>", "base64": false}, {"type": "text/markdown", "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files `lib/inets/src/http_server/httpd_request.erl` and program routines `httpd_request:parse_headers/7`.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests"}]}], "configurations": [{"lang": "en", "value": "The inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default).", "supportingMedia": [{"type": "text/html", "value": "<p>The inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default).</p>", "base64": false}, {"type": "text/markdown", "value": "The inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default).", "base64": false}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "26.2.5.18"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0"}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-11-11T19:45:01.134Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23941", "state": "PUBLISHED", "dateUpdated": "2026-11-11T19:45:01.134Z", "dateReserved": "2026-01-19T14:23:14.343Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-03-13T09:11:58.175Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["httpd_request"], "packageName": "otp", "packageURL": "pkg:software-id/erlang.org/otp", "product": "OTP", "programFiles": ["lib/inets/src/http_server/httpd_request.erl"], "programRoutines": [{"name": "httpd_request:parse_headers/7"}], "vendor": "Erlang", "versions": [{"changes": [{"at": "26.2.5.18", "status": "unaffected"}, {"at": "27.3.4.9", "status": "unaffected"}, {"at": "28.4.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "17.0", "versionType": "otp"}]}, {"cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["httpd_request"], "packageName": "inets", "packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git", "product": "OTP", "programFiles": ["src/http_server/httpd_request.erl"], "programRoutines": [{"name": "httpd_request:parse_headers/7"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "9.1.0.5", "status": "unaffected"}, {"at": "9.3.2.3", "status": "unaffected"}, {"at": "9.6.1", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "5.10", "versionType": "otp"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["httpd_request"], "packageName": "erlang/otp", "packageURL": "pkg:github/erlang/otp", "product": "OTP", "programFiles": ["lib/inets/src/http_server/httpd_request.erl"], "programRoutines": [{"name": "httpd_request:parse_headers/7"}], "repo": "https://github.com/erlang/otp", "vendor": "Erlang", "versions": [{"changes": [{"at": "e775a332f623851385ab6ddb866d9b150612ddf6", "status": "unaffected"}, {"at": "a761d391d8d08316cbd7d4a86733ba932b73c45b", "status": "unaffected"}, {"at": "a4b46336fd25aa100ac602eb9a627aaead7eda18", "status": "unaffected"}], "lessThan": "*", "status": "affected", "version": "84adefa331c4159d432d22840663c38f155cd4c1", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "e775a332f623851385ab6ddb866d9b150612ddf6", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "a761d391d8d08316cbd7d4a86733ba932b73c45b", "versionType": "git"}, {"lessThan": "*", "status": "unaffected", "version": "a4b46336fd25aa100ac602eb9a627aaead7eda18", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:erlang:erlang\\/inets:*:*:*:*:*:*:*:*", "matchCriteriaId": "51F23E56-D6A0-4406-BF11-862502FAFE38", "versionEndExcluding": "9.1.0.5", "versionStartIncluding": "5.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/inets:*:*:*:*:*:*:*:*", "matchCriteriaId": "61E04989-9259-49AF-866D-98385A3A1EA0", "versionEndExcluding": "9.3.2.3", "versionStartIncluding": "9.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/inets:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2EA5EC1-0077-459E-A77C-A5CE93AF737D", "versionEndExcluding": "9.6.1", "versionStartIncluding": "9.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "6241E245-67D2-4FA6-83FE-4E9A4A07B3D1", "versionEndExcluding": "26.2.5.18", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE60BA92-431E-4DE3-A1C1-E8976E3A6BA7", "versionEndExcluding": "27.3.4.9", "versionStartIncluding": "27.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8D9E80B-CA20-423A-A1A8-DEBB99D82BDB", "versionEndExcluding": "28.4.1", "versionStartIncluding": "28.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a026.2.5.18, OTP\u00a027.3.4.9, and OTP\u00a028.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."}, {"lang": "es", "value": "La vulnerabilidad de Interpretaci\u00f3n inconsistente de solicitudes HTTP ('Contrabando de solicitudes HTTP') en Erlang OTP (m\u00f3dulo inets httpd) permite el contrabando de solicitudes HTTP.\n\nEsta vulnerabilidad est\u00e1 asociada con los archivos de programa lib/inets/src/http_server/httpd_request.erl y las rutinas de programa httpd_request:parse_headers/7.\n\nEl servidor no rechaza ni normaliza los encabezados Content-Length duplicados. El Content-Length m\u00e1s temprano en la solicitud se utiliza para el an\u00e1lisis del cuerpo, mientras que los proxies inversos comunes (nginx, Apache httpd, Envoy) respetan el \u00faltimo valor de Content-Length. Esto viola la Secci\u00f3n 6.3 de RFC 9112 y permite la desincronizaci\u00f3n front-end/back-end, dejando bytes controlados por el atacante en cola como el inicio de la siguiente solicitud.\n\nEste problema afecta a OTP desde OTP 17.0 hasta OTP 28.4.1, OTP 27.3.4.9 y OTP 26.2.5.18, lo que corresponde a inets desde 5.10 hasta 9.6.1, 9.3.2.3 y 9.1.0.5."}], "id": "CVE-2026-23941", "lastModified": "2026-11-11T20:17:07.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23941", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T16:00:50.466386Z", "version": "2.0.3"}}]}, "published": "2026-03-13T19:54:15.237", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-23941.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Patch"], "url": "https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Vendor Advisory"], "url": "https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Third Party Advisory"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-23941"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "tags": ["Product"], "url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10,9.6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[9.6.1,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[pkg:otp/inets@5.10,pkg:otp/inets@9.6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[pkg:otp/inets@9.6.1,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "erlang/otp", "vendor": "erlang"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17.0,28.4.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[28.4.1,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,a4b46336fd25aa100ac602eb9a627aaead7eda18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[a4b46336fd25aa100ac602eb9a627aaead7eda18,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "OTP", "source": "cna", "vendor": "Erlang"}, "product": "erlang/otp", "vendor": "erlang"}], "created": "2026-03-16T09:37:47.940364+00:00", "updated": "2026-08-04T19:15:03.932548+00:00", "vendors": ["erlang", "erlang$PRODUCT$erlang/otp"]}