CVE-2026-73276 inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
Attackers can exploit HTTP request smuggling in Erlang OTP's inets httpd server by dropping headers with whitespace before colons, bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73276?
CVE-2026-73276 is a high-severity vulnerability in Erlang OTP, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Weakness: CWE-444
Which versions are affected by CVE-2026-73276?
How do I fix CVE-2026-73276?
Upgrade to a fixed version.
Is CVE-2026-73276 being exploited?
There is no known exploitation of CVE-2026-73276 in the wild and no public exploit code.
Sources
Also known as AZL-98487, DEBIAN-CVE-2026-73276, EEF-CVE-2026-73276, GHSA-6v7q-jwgh-cx8p, UBUNTU-CVE-2026-73276.