CVE-2026-73276: inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
Other sources
inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 26.2.5.21-6 - Upgrade
Upgrade
debian/erlangto a version that resolves this vulnerability.Fixed in 1:29.0.6+dfsg-1Fixed in 1:29.1.1+dfsg-1 - Upgrade
Upgrade
OTPto a version that resolves this vulnerability.Fixed in 27.3.4.17 - Upgrade
Upgrade
OTPto a version that resolves this vulnerability.Fixed in 28.5.0.6 - Upgrade
Upgrade
OTPto a version that resolves this vulnerability.Fixed in 29.0.6 - Upgrade
Upgrade
inetsto a version that resolves this vulnerability.Fixed in 9.3.2.7 - Upgrade
Upgrade
inetsto a version that resolves this vulnerability.Fixed in 9.6.2.3 - Upgrade
Upgrade
inetsto a version that resolves this vulnerability.Fixed in 9.7.2
Event History
Frequently Asked Questions
Which versions contain the fix?
The issue is fixed in OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6. The corresponding fixed inets versions are 9.3.2.7, 9.6.2.3, and 9.7.2.
Which release ranges are affected?
Affected OTP releases are 22.2 through versions before 27.3.4.17, 28.0 through versions before 28.5.0.6, and 29.0 through versions before 29.0.6. Corresponding affected inets ranges are 7.1.2 through versions before 9.3.2.7, 9.4 through versions before 9.6.2.3, and 9.7 through versions before 9.7.2.