{"id":"CVE-2016-1000107","aliases":["DEBIAN-CVE-2016-1000107","EUVD-2016-1052","GHSA-v875-g963-fhg4","UBUNTU-CVE-2016-1000107","openSUSE-SU-2025:15706-1"],"status":"published","title":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not...","description":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01475,"percentile":0.73986,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2019-12-10T17:32:33Z","modified":"2026-10-24T10:30:40Z","fixes":[{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:27.3.4.1+dfsg-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:27.3.4.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"erlang","fixed_in":["28.1.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:25.2.3+dfsg-1","1:25.2.3+dfsg-1+deb12u1","1:25.2.3+dfsg-1+deb12u2","1:25.2.3+dfsg-1+deb12u3","1:25.2.3+dfsg-1+deb12u4","1:25.3.2.10+dfsg-1","1:25.3.2.10+dfsg-2","1:25.3.2.11+dfsg-1","1:25.3.2.12+dfsg-1","1:25.3.2.12+dfsg-2","1:25.3.2.12+dfsg-3","1:25.3.2.8+dfsg-1","1:26.0+dfsg-1","1:26.0.1+dfsg-1","1:26.0.2+dfsg-1","1:26.0~rc2+dfsg-1","1:26.0~rc3+dfsg-1","1:26.1.2+dfsg-1","1:26.2.1+dfsg-1","1:26.2.4+dfsg-1","1:27.0+dfsg-1","1:27.0.1+dfsg-1","1:27.0.1+dfsg-2","1:27.0.1+dfsg-3","1:27.0~rc3+dfsg-1","1:27.0~rc3+dfsg-2","1:27.0~rc3+dfsg-3","1:27.0~rc3+dfsg-4","1:27.1.2+dfsg-1","1:27.2+dfsg-1","1:27.2+dfsg-2","1:27.2+dfsg-3~exp1","1:27.2.1+dfsg-1","1:27.2.1+dfsg-2","1:27.2.2+dfsg-1","1:27.2.3+dfsg-1","1:27.2.4+dfsg-1","1:27.3+dfsg-1","1:27.3.1+dfsg-1","1:27.3.2+dfsg-1","1:27.3.3+dfsg-1","1:27.3.4+dfsg-1","1:27.3.4.1+dfsg-1","1:27.3.4.10+dfsg-1","1:27.3.4.11+dfsg-1","1:27.3.4.11+dfsg-2","1:27.3.4.11+dfsg-3","1:27.3.4.11+dfsg-4","1:27.3.4.11+dfsg-5","1:27.3.4.11+dfsg-6","1:27.3.4.11+dfsg-7","1:27.3.4.12+dfsg-1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1","1:27.3.4.8+dfsg-1","1:27.3.4.9+dfsg-1","1:28.0+dfsg-1","1:28.0.1+dfsg-1","1:28.0.2+dfsg-1","1:28.0.4+dfsg-1","1:28.1.1+dfsg-1","1:28.2+dfsg-1","1:28.3+dfsg-1","1:28.3.1+dfsg-1","1:29.0+dfsg-1","1:29.0+dfsg-2","1:29.0.1+dfsg-1","1:29.0.2+dfsg-1","1:29.0.3+dfsg-1","1:29.0.4+dfsg-1","1:29.0.6+dfsg-1","1:29.0~rc1+dfsg-1","1:29.0~rc1+dfsg-2","1:29.0~rc2+dfsg-1","1:29.0~rc3+dfsg-1","1:29.0~rc3+dfsg-2","1:29.0~rc3+dfsg-3","1:29.0~rc3+dfsg-4"]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.1+dfsg-1+deb13u1"}]}],"versions":["1:27.3.4.1+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.3+dfsg-1"}]}],"versions":["1:27.3.4.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2","1:16.b.3-dfsg-1ubuntu2.2+esm1","1:16.b.3-dfsg-1ubuntu2.2+esm2","1:16.b.3-dfsg-1ubuntu2.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1","1:18.3-dfsg-1ubuntu3.1+esm2","1:18.3-dfsg-1ubuntu3.1+esm3","1:18.3-dfsg-1ubuntu3.1+esm4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.1.1-1.1"}]}]}],"products":[{"vendor":"erlang","product":"erlang\\/otp"}],"references":[{"url":"https://httpoxy.org/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1000107","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/07/18/6","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://bugs.erlang.org/browse/ERL-198","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000107"},{"url":"https://httpoxy.org"},{"url":"https://github.com/advisories/GHSA-v875-g963-fhg4"},{"url":"https://ubuntu.com/security/CVE-2016-1000107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1000107","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1000107","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-1000107","description":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.","status":"published","published":"2019-12-10T17:32:33Z","modified":"2024-08-06T03:55:26.481Z","updated_at":"2026-11-02T14:33:36.802481Z"}],"euvd":[{"id":"EUVD-2016-1052","description":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.","status":"published","published":"2019-12-10T17:32:33Z","modified":"2024-08-06T03:55:26Z","updated_at":"2026-11-03T02:22:21.756675Z"}],"ghsa":[{"id":"GHSA-v875-g963-fhg4","title":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not...","description":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.","status":"published","published":"2022-05-24T17:02:56Z","modified":"2024-04-04T02:42:27Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:56:11.047077Z"}],"nvd":[{"id":"CVE-2016-1000107","description":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.","status":"published","published":"2019-12-10T18:15:09.14Z","modified":"2026-06-17T00:38:41.257Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"CVE-2016-1000107","description":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.","status":"published","published":"2019-12-10T18:15:09.14Z","modified":"2026-10-24T10:30:40.292313613Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-1000107","description":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.","status":"published","published":"2019-12-10T18:15:09.14Z","modified":"2026-09-22T07:01:06.87258872Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1000107","description":"inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.","status":"published","published":"2019-12-10T18:15:00Z","modified":"2026-10-08T12:49:42.148133499Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"openSUSE-SU-2025:15706-1","title":"erlang-28.1.1-1.1 on GA media","description":"These are all security issues fixed in the erlang-28.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-06T00:00:00Z","modified":"2026-03-23T04:54:07.367386Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}