{"id":"CVE-2026-23941","aliases":["AZL-79880","DEBIAN-CVE-2026-23941","EEF-CVE-2026-23941","EUVD-2026-11776","GHSA-w4jc-9wpv-pqh7","OESA-2026-1665","OESA-2026-1666","OESA-2026-1667","OESA-2026-1668","OESA-2026-2704","SUSE-SU-2026:1714-1","SUSE-SU-2026:2010-1","SUSE-SU-2026:21374-1","UBUNTU-CVE-2026-23941","USN-8827-1","openSUSE-SU-2026:10947-1","openSUSE-SU-2026:20607-1"],"status":"published","title":"Request smuggling via first-wins Content-Length parsing in inets httpd","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.","severity":{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00514,"percentile":0.44313,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2026-03-13T09:11:58Z","modified":"2026-11-11T20:17:07Z","fixes":[{"ecosystem":"Azure Linux:3","package":"erlang","fixed_in":["26.2.5.18-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"erlang","fixed_in":["1:25.2.3+dfsg-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:27.3.4.1+dfsg-1+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:27.3.4.9+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","fixed_in":["1:16.b.3-dfsg-1ubuntu2.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","fixed_in":["1:18.3-dfsg-1ubuntu3.1+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","fixed_in":["1:20.2.2+dfsg-1ubuntu2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","fixed_in":["1:22.2.7+dfsg-1ubuntu0.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"erlang","fixed_in":["1:24.2.1+dfsg-1ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"erlang","fixed_in":["1:25.3.2.8+dfsg-1ubuntu4.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"erlang","fixed_in":["1:27.3.4.6+dfsg-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.5.18-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.2.3+dfsg-1+deb12u4"}]}],"versions":["1:25.2.3+dfsg-1","1:25.2.3+dfsg-1+deb12u1","1:25.2.3+dfsg-1+deb12u2","1:25.2.3+dfsg-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.1+dfsg-1+deb13u2"}]}],"versions":["1:27.3.4.1+dfsg-1","1:27.3.4.1+dfsg-1+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.9+dfsg-1"}]}],"versions":["1:27.3.4.1+dfsg-1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1","1:27.3.4.8+dfsg-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-13.oe2403sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-13.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-13.oe2403"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.3.2.6-13.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.4.9-10.oe2203sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2+esm2"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2","1:16.b.3-dfsg-1ubuntu2.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1+esm3"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1","1:18.3-dfsg-1ubuntu3.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.2.2+dfsg-1ubuntu2+esm3"}]}],"versions":["1:20.0.4+dfsg-1ubuntu1","1:20.1.2+dfsg-1ubuntu1","1:20.1.3+dfsg-1ubuntu1","1:20.1.4+dfsg-1ubuntu1","1:20.1.5+dfsg-1ubuntu1","1:20.1.6+dfsg-1ubuntu1","1:20.1.7+dfsg-1ubuntu1","1:20.2.1+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu2","1:20.2.2+dfsg-1ubuntu2+esm1","1:20.2.2+dfsg-1ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.5+esm2"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1","1:22.2.7+dfsg-1ubuntu0.2","1:22.2.7+dfsg-1ubuntu0.3","1:22.2.7+dfsg-1ubuntu0.4","1:22.2.7+dfsg-1ubuntu0.5","1:22.2.7+dfsg-1ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.7"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1","1:24.2.1+dfsg-1ubuntu0.1","1:24.2.1+dfsg-1ubuntu0.2","1:24.2.1+dfsg-1ubuntu0.3","1:24.2.1+dfsg-1ubuntu0.4","1:24.2.1+dfsg-1ubuntu0.5","1:24.2.1+dfsg-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.7"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4","1:25.3.2.8+dfsg-1ubuntu4.5","1:25.3.2.8+dfsg-1ubuntu4.6"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:27.3+dfsg-1ubuntu1","1:27.3+dfsg-1ubuntu1.1","1:27.3.4.1+dfsg-1","1:27.3.4.1+dfsg-1build1","1:27.3.4.1+dfsg-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.6+dfsg-1ubuntu0.1"}]}],"versions":["1:27.3.4.1+dfsg-1build1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2+esm2"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1","1:16.b.3-dfsg-1ubuntu2.2","1:16.b.3-dfsg-1ubuntu2.2+esm1"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1+esm3"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3","1:18.3-dfsg-1ubuntu3.1","1:18.3-dfsg-1ubuntu3.1+esm1","1:18.3-dfsg-1ubuntu3.1+esm2"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:20.2.2+dfsg-1ubuntu2+esm3"}]}],"versions":["1:20.0.4+dfsg-1ubuntu1","1:20.1.2+dfsg-1ubuntu1","1:20.1.3+dfsg-1ubuntu1","1:20.1.4+dfsg-1ubuntu1","1:20.1.5+dfsg-1ubuntu1","1:20.1.6+dfsg-1ubuntu1","1:20.1.7+dfsg-1ubuntu1","1:20.2.1+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu1","1:20.2.2+dfsg-1ubuntu2","1:20.2.2+dfsg-1ubuntu2+esm1","1:20.2.2+dfsg-1ubuntu2+esm2"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:22.2.7+dfsg-1ubuntu0.5+esm2"}]}],"versions":["1:22.0.7+dfsg-1build1","1:22.2+dfsg-1","1:22.2.1+dfsg-1","1:22.2.2+dfsg-1","1:22.2.3+dfsg-1","1:22.2.3+dfsg-2","1:22.2.4+dfsg-1","1:22.2.7+dfsg-1","1:22.2.7+dfsg-1ubuntu0.2","1:22.2.7+dfsg-1ubuntu0.3","1:22.2.7+dfsg-1ubuntu0.4","1:22.2.7+dfsg-1ubuntu0.5","1:22.2.7+dfsg-1ubuntu0.5+esm1"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:24.2.1+dfsg-1ubuntu0.7"}]}],"versions":["1:23.2.6+dfsg-1build1","1:24.1.1+dfsg-1","1:24.1.4+dfsg-1","1:24.1.5+dfsg-1","1:24.1.5+dfsg-1ubuntu1","1:24.2+dfsg-1","1:24.2.1+dfsg-1","1:24.2.1+dfsg-1ubuntu0.1","1:24.2.1+dfsg-1ubuntu0.2","1:24.2.1+dfsg-1ubuntu0.3","1:24.2.1+dfsg-1ubuntu0.4","1:24.2.1+dfsg-1ubuntu0.5","1:24.2.1+dfsg-1ubuntu0.6"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:25.3.2.8+dfsg-1ubuntu4.7"}]}],"versions":["1:25.2.3+dfsg-1","1:25.3.2.8+dfsg-1","1:25.3.2.8+dfsg-1ubuntu1","1:25.3.2.8+dfsg-1ubuntu3","1:25.3.2.8+dfsg-1ubuntu4","1:25.3.2.8+dfsg-1ubuntu4.1","1:25.3.2.8+dfsg-1ubuntu4.2","1:25.3.2.8+dfsg-1ubuntu4.3","1:25.3.2.8+dfsg-1ubuntu4.4","1:25.3.2.8+dfsg-1ubuntu4.5","1:25.3.2.8+dfsg-1ubuntu4.6"],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:27.3.4.6+dfsg-1ubuntu0.1"}]}],"versions":["1:27.3.4.1+dfsg-1build1","1:27.3.4.3+dfsg-1","1:27.3.4.4+dfsg-1","1:27.3.4.6+dfsg-1"],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"erlang27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1.3-2.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.1.3-160000.4.1"}]}],"bundled":7}],"products":[{"vendor":"erlang","product":"erlang\\/inets"},{"vendor":"erlang","product":"erlang\\/otp"},{"vendor":"erlang","product":"otp"}],"references":[{"url":"https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7","tags":["vendor-advisory","related","Vendor Advisory","advisory","report"]},{"url":"https://cna.erlef.org/cves/CVE-2026-23941.html","tags":["related","Vendor Advisory","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-23941","tags":["related","Third Party Advisory","web"]},{"url":"https://www.erlang.org/doc/system/versions.html#order-of-versions","tags":["x_version-scheme","Product","web","report"]},{"url":"https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18","tags":["patch","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23941","tags":["web","advisory"]},{"url":"https://github.com","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23941.json","tags":["advisory"]},{"url":"https://github.com/erlang/otp","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-23941","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23942","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23943","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1666","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1667","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1668","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21620","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261714-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258663","tags":["report"]},{"url":"https://bugzilla.suse.com/1259681","tags":["report"]},{"url":"https://bugzilla.suse.com/1259682","tags":["report"]},{"url":"https://bugzilla.suse.com/1259687","tags":["report"]},{"url":"https://bugzilla.suse.com/1261728","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28808","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262010-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262503","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32147","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621374-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261726","tags":["report"]},{"url":"https://bugzilla.suse.com/1261734","tags":["report"]},{"url":"https://bugzilla.suse.com/1262288","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32144","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-23941","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-23941","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8827-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-42792","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-54890","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55951","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-55953","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-58227","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59250","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-59251","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66357","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-66835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-69664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-70399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-71380","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73270","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73276","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-73812","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-74835","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-75538","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42791","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-23941","title":"Request smuggling via first-wins Content-Length parsing in inets httpd","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.","status":"published","published":"2026-03-13T09:11:58.175Z","modified":"2026-11-11T19:45:01.134Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-11T21:33:02.552103Z"}],"euvd":[{"id":"EUVD-2026-11776","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.","status":"published","published":"2026-03-13T09:11:58Z","modified":"2026-11-11T19:45:01Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L","level":"high"}],"updated_at":"2026-11-11T21:30:30.338248Z"}],"nvd":[{"id":"CVE-2026-23941","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.","status":"published","published":"2026-03-13T19:54:15.237Z","modified":"2026-11-11T20:17:07.93Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-11T21:26:14.394Z"}],"osv":[{"id":"CVE-2026-23941","title":"Request smuggling via first-wins Content-Length parsing in inets httpd","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.","status":"published","published":"2026-03-13T09:11:58.175Z","modified":"2026-11-12T10:45:35.169420006Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-12T11:17:24.122775Z"},{"id":"DEBIAN-CVE-2026-23941","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.  This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.  The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.  This issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.","status":"published","published":"2026-03-13T19:54:15.237Z","modified":"2026-11-12T09:47:30.893918766Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-12T05:32:35.067145Z"},{"id":"EEF-CVE-2026-23941","title":"Request smuggling via first-wins Content-Length parsing in inets httpd","description":"## Summary\n\nInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files `lib/inets/src/http_server/httpd_request.erl` and program routines `httpd_request:parse_headers/7`.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.\n\n## Workarounds\n\n* Configure frontend proxy to reject requests with duplicate Content-Length headers.\n* Disable HTTP keep-alive on httpd by adding `{keep_alive, false}` to httpd configuration. Note: This impacts performance for clients making multiple requests.\n* Deploy a Web Application Firewall (WAF) configured to reject requests with multiple Content-Length headers.\n\n## Configurations\n\nThe inets httpd server must be deployed behind a reverse proxy that honors a different Content-Length header than httpd (e.g., last vs. first). HTTP keep-alive must be enabled (the default).","status":"published","published":"2026-03-13T09:11:58.175Z","modified":"2026-11-11T19:45:03.103493548Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L","level":"high"}],"cwes":["CWE-444"],"updated_at":"2026-11-11T19:50:24.684142Z"},{"id":"OESA-2026-1665","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.503288393Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1666","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:40.473583288Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1667","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:40.48726561Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-1668","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson.\r\n\r\nSecurity Fix(es):\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-03-20T11:10:42Z","modified":"2026-08-18T01:19:41.531621087Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"OESA-2026-2704","title":"erlang security update","description":"Erlang is a general-purpose programming language and runtime\nenvironment. Erlang has built-in support for concurrency, distribution\nand fault tolerance. Erlang is used in several large telecommunication\nsystems from Ericsson.\r\n\r\n\nSecurity Fix(es):\n\nRelative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.\n\nThis issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.(CVE-2026-21620)\n\nInconsistent Interpretation of HTTP Requests (\u0026apos;HTTP Request Smuggling\u0026apos;) vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 until 9.6.1, 9.3.2.3 and 9.1.0.5.(CVE-2026-23941)\n\nImproper Limitation of a Pathname to a Restricted Directory (\u0026apos;Path Traversal\u0026apos;) vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.\n\nThis vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2.\n\nThe SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if root is set to /home/user1, paths like /home/user10 or /home/user1_backup would incorrectly be considered within the root.\n\nThis issue affects OTP from OTP 17.0 until OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to ssh from 3.0.1 until 5.5.1, 5.2.11.6 and 5.1.4.14.(CVE-2026-23942)\n\nImproper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion.\n\nThe SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS.\n\nTwo compression algorithms are affected:\n\n* zlib: Activates immediately after key exchange, enabling unauthenticated attacks\n* (CVE-2026-23943)","status":"published","published":"2026-06-24T11:11:38Z","modified":"2026-08-18T01:20:05.995131714Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-23941","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5.","status":"published","published":"2026-03-13T19:54:00Z","modified":"2026-09-28T22:45:10.800032028Z","cvss":[{"version":"4.0","score":7,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L","level":"high"},{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T16:56:08.726452Z"},{"id":"AZL-79880","title":"CVE-2026-23941 affecting package erlang for versions less than 26.2.5.18-1","description":"Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling.\n\nThis vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7.\n\nThe server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request.\n\nThis issue affects OTP from OTP 17.0 before OTP 26.2.5.18, OTP 27.3.4.9, and OTP 28.4.1, corresponding to inets from 5.10 before 9.1.0.5, 9.3.2.3, and 9.6.1. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.","status":"published","published":"2026-03-13T19:54:15Z","modified":"2026-11-12T14:16:50.535360745Z","updated_at":"2026-11-12T14:53:16.116152Z"},{"id":"openSUSE-SU-2026:10947-1","title":"erlang27-27.1.3-2.1 on GA media","description":"These are all security issues fixed in the erlang27-27.1.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-03T00:00:00Z","modified":"2026-06-04T09:00:08.489232736Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20607-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and remote\n  arbitrary reads/writes (bsc#1258663).\n- CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP request\n  smuggling (bsc#1259687).\n- CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead to path\n  traversal (bsc#1259681).\n- CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of service\n  (bsc#1259682).\n- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).\n- CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).\n- CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information disclosure\n  (bsc#1261734).\n\nOther updates and bugfixes:\n\n- jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).\n","status":"published","published":"2026-04-22T10:52:20Z","modified":"2026-04-24T08:16:29.068648Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1714-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\n- CVE-2026-21620: remote arbitrary read/write via TFTP relative path traversal (bsc#1258663).\n- CVE-2026-23941: HTTP Request Smuggling in Erlang OTP (bsc#1259687).\n- CVE-2026-23942: path traversal vulnerability in Erlang OTP (bsc#1259681).\n- CVE-2026-23943: denial of service due to improper handling of highly compressed data in Erlang OTP ssh (bsc#1259682).\n- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).\n","status":"published","published":"2026-05-06T12:08:10Z","modified":"2026-05-07T08:46:27.139005Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2010-1","title":"Security update for erlang26","description":"This update for erlang26 fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-21620: remote arbitrary read/write via TFTP relative path traversal (bsc#1258663).\n- CVE-2026-23941: HTTP Request Smuggling in Erlang OTP (bsc#1259687).\n- CVE-2026-23942: path traversal vulnerability in Erlang OTP (bsc#1259681).\n- CVE-2026-23943: denial of service due to improper handling of highly compressed data in Erlang OTP ssh (bsc#1259682).\n- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).\n- CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot\n  (bsc#1262503).\n\nNon security issue:\n\n- Fixes for FIPS mode (jsc#PED-15166.\n","status":"published","published":"2026-05-19T11:56:05Z","modified":"2026-05-20T08:00:18.312055064Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21374-1","title":"Security update for erlang","description":"This update for erlang fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2026-21620: improper isolation and compartmentalization can lead to TFTP relative path traversal and remote\n  arbitrary reads/writes (bsc#1258663).\n- CVE-2026-23941: improper handling of duplicate Content-Length headers in Erlang OTP can lead to HTTP request\n  smuggling (bsc#1259687).\n- CVE-2026-23942: improper limitation of a pathname to a restricted directory in the SFTP server can lead to path\n  traversal (bsc#1259681).\n- CVE-2026-23943: improper handling of highly compressed data in Erlang OTP ssh can lead to denial of service\n  (bsc#1259682).\n- CVE-2026-28808: incorrect authorization can lead to unauthenticated access to protected CGI scripts (bsc#1261728).\n- CVE-2026-28810: predictable DNS transaction IDs can lead to DNS cache poisoning (bsc#1261726).\n- CVE-2026-32144: missing signature verification can lead to OCSP authorization bypass and information disclosure\n  (bsc#1261734).\n\nOther updates and bugfixes:\n\n- jinterface: allow to build determenistic OtpErlang.jar (bsc#1262288).\n","status":"published","published":"2026-04-22T11:46:09Z","modified":"2026-04-29T18:23:58.002335Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8827-1","title":"erlang vulnerabilities","description":"It was discovered that the Erlang Port Mapper Daemon did not properly\nhandle slow connections. A remote attacker could possibly use this issue\nto cause a denial of service. (CVE-2026-42792)\n\nIt was discovered that Erlang incorrectly handled certain external term\nformat data, leading to heap corruption. An attacker could possibly use\nthis issue to cause Erlang to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.\n(CVE-2026-55737)\n\nIt was discovered that Erlang incorrectly handled invalid external term\nformat data. An attacker could possibly use this issue to cause Erlang to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n26.04 LTS. (CVE-2026-54890)\n\nIt was discovered that Erlang incorrectly handled certain packet lengths,\nleading to a buffer overflow. A remote attacker could possibly use this\nissue to cause Erlang to crash or execute arbitrary code. (CVE-2026-75538)\n\nIt was discovered that the Erlang Megaco flex scanner incorrectly handled\ncertain input, leading to a buffer overflow. A remote attacker could\npossibly use this issue to cause Erlang to crash or execute arbitrary code.\n(CVE-2026-59250)\n\nIt was discovered that Erlang TLS clients incorrectly accepted cipher\nsuites that they had not offered. A remote attacker could possibly use\nthis issue to intercept and modify TLS communications. (CVE-2026-55953)\n\nIt was discovered that Erlang incorrectly handled certain certificate\nchains. A remote attacker could possibly use this issue to cause Erlang to\nuse excessive resources, leading to a denial of service. This issue only\naffected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-58227)\n\nIt was discovered that Erlang incorrectly handled certain certificate\npolicies. A remote attacker could possibly use this issue to cause Erlang\nto use excessive resources, leading to a denial of service. This issue only\naffected Ubuntu 26.04 LTS. (CVE-2026-59251)\n\nIt was discovered that the Erlang HTTP server incorrectly handled certain\nconflicting HTTP framing headers. A remote attacker could possibly use this\nissue to smuggle HTTP requests. (CVE-2026-23941, CVE-2026-73812)\n\nIt was discovered that the Erlang HTTP server incorrectly handled certain\nmalformed chunk sizes. A remote attacker could possibly use this issue to\ncause Erlang to crash, resulting in a denial of service. (CVE-2026-69664)\n\nIt was discovered that the Erlang HTTP server did not properly limit the\nsize of chunked request bodies. A remote attacker could possibly use this\nissue to cause Erlang to use excessive resources, leading to a denial of\nservice. (CVE-2026-74835)\n\nIt was discovered that the Erlang HTTP server incorrectly handled certain\nequivalent request paths and differences in character case. A remote\nattacker could possibly use this issue to bypass authentication and gain\nunauthorized access. (CVE-2026-66835, CVE-2026-73270)\n\nIt was discovered that the Erlang HTTP server did not properly limit\nsimultaneous connections. A remote attacker could possibly use this issue\nto cause Erlang to use excessive resources, leading to a denial of service.\nThis issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-70399)\n\nIt was discovered that the Erlang HTTP server incorrectly handled header\ncontinuation lines. A remote attacker could possibly use this issue to\nsmuggle HTTP requests. (CVE-2026-66357)\n\nIt was discovered that the Erlang HTTP server incorrectly handled certain\nmalformed header names. A remote attacker could possibly use this issue to\nsmuggle HTTP requests. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-73276)\n\nIt was discovered that the Erlang HTTP server incorrectly handled\nincomplete request bodies. A remote attacker could possibly use this issue\nto cause Erlang to use excessive resources, leading to a denial of service.\n(CVE-2026-71380)\n\nIt was discovered that the Erlang HTTP client did not properly limit the\nsize of HTTP response headers. A malicious HTTP server could possibly use\nthis issue to cause Erlang to use excessive resources, leading to a denial\nof service. (CVE-2026-55951)\n\nIt was discovered that Erlang did not properly limit the length of port\nnumbers when parsing URIs. A remote attacker could possibly use this issue\nto cause Erlang to use excessive resources, leading to a denial of service.\nThis issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-59696)\n\nIt was discovered that the Erlang SNMP application did not properly limit\nthe size of certain integer values. A remote attacker could possibly use\nthis issue to cause Erlang to use excessive resources, leading to a denial\nof service. (CVE-2026-70405)\n\nIt was discovered that the Erlang LDAP client did not properly limit the\nlength of port numbers in referral URLs. A malicious LDAP server could\npossibly use this issue to cause Erlang to use excessive resources, leading\nto a denial of service. (CVE-2026-70409)","status":"published","published":"2026-09-28T13:21:58Z","modified":"2026-09-28T22:57:44.139860303Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}