Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-73276— inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

Quick assessment

Affected

Erlang OTP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/OTP是Erlang/OTP团队开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 22.2至27.3.4.17之前版本、28.0至28.5.0.6之前版本和29.0至29.0.6之前版本存在输入验证错误漏洞，该漏洞源于Gracefulness代码忽略了本应拒绝的情况，可能导致HTTP请求夹带攻击。

CVSS 8.3 · High EPSS 0.58% · P47 Updated Sep 08, 2026

Possible ATT&CK Techniques 1 AI

T1557 · Adversary-in-the-Middle

Affected Version Matrix 7

Vendor	Product	Version Range	Status
Erlang	OTP	`22.2< 27.3.4.17`	affected
		`28.0< 28.5.0.6`	affected
		`29.0< 29.0.6`	affected
		`7.1.2< 9.3.2.7`	affected
		`9.4< 9.6.2.3`	affected
		`9.7< 9.7.2`	affected
		`c06db0bedf49a9b40725745e73fa82e562612815< *`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73276

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

Source: CVE Program / CVE List V5

Vulnerability Description

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

HTTP请求的解释不一致性(HTTP请求私运)

Source: CVE Program / CVE List V5

Vulnerability Title

Erlang/OTP 输入验证错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Erlang	OTP	22.2 ~ 27.3.4.17	`cpe:2.3:a:erlang:erlang\/otp::::::::`
Erlang	OTP	7.1.2 ~ 9.3.2.7	`cpe:2.3:a:erlang:erlang\/otp::::::::`
Erlang	OTP	c06db0bedf49a9b40725745e73fa82e562612815 ~ *	`cpe:2.3:a:erlang:erlang\/otp::::::::`

II. Public POCs for CVE-2026-73276

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-73276

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73276 (3)

Vendor Advisories for CVE-2026-73276 (2)

🔗 EEF-CVE-2026-73276 - OSV related
🔗 HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping in httpd · Advisory · erlang/otp · GitHub vendor-advisory

Vendor Pages for CVE-2026-73276 (1)

🔗 CVE-2026-73276 related

https://www.cve.org/CVERecord?id=CVE-2026-73276

Same Patch Batch · Erlang · 2026-09-01 · 16 CVEs total

CVE-2026-71380	8.7 HIGH	httpd applies no timeout while receiving a request body, parking a worker on a stalled cli
CVE-2026-70399	8.7 HIGH	httpd does not enforce the documented default max_clients connection limit
CVE-2026-74835	8.7 HIGH	inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
CVE-2026-69664	8.7 HIGH	httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
CVE-2026-66357	8.3 HIGH	inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
CVE-2026-73812	8.3 HIGH	inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
CVE-2026-55951	8.2 HIGH	httpc memory exhaustion via unbounded response header accumulation
CVE-2026-75538	8.2 HIGH	A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into
CVE-2026-66835	8.2 HIGH	httpd mod_auth directory protection bypassed by a doubled slash in the request path
CVE-2026-73270	8.2 HIGH	httpd mod_auth directory protection bypassed by request path casing on case-insensitive fi
CVE-2026-59696	6.9 MEDIUM	uri_string does not bound the port component of a URI before integer conversion
CVE-2026-71562	6.3 MEDIUM	httpc does not bound server-supplied numeric header values before integer conversion
CVE-2026-70405	6.3 MEDIUM	snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
CVE-2026-70409	6.3 MEDIUM	eldap does not bound the port component of a referral URL before integer conversion
CVE-2026-74994	6.0 MEDIUM	inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

IV. Related Vulnerabilities

Same product: OTP

Same vendor: Erlang

Same weakness: CWE-444