CVE-2026-73276: inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

Q: Which versions contain the fix?

The issue is fixed in OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6. The corresponding fixed inets versions are 9.3.2.7, 9.6.2.3, and 9.7.2.

Q: Which release ranges are affected?

Affected OTP releases are 22.2 through versions before 27.3.4.17, 28.0 through versions before 28.5.0.6, and 29.0 through versions before 29.0.6. Corresponding affected inets ranges are 7.1.2 through versions before 9.3.2.7, 9.4 through versions before 9.6.2.3, and 9.7 through versions before 9.7.2.

Published Sep 1, 2026

Updated

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.

This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Affected Software

3 affected components

OpenOTP OTP>22.2<=27.3.4.17, >28.0<=28.5.0.6, >29.0<=29.0.6

inets>7.1.2<=9.3.2.7, >9.4<=9.6.2.3, >9.7<=9.7.2

httpd

Event History

Sep 1, 2026

CVE Published

via MITRE·02:41 PM

Data Sourced

via MITRE·02:41 PM

DescriptionWeakness

Frequently Asked Questions

Which versions contain the fix?

The issue is fixed in OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6. The corresponding fixed inets versions are 9.3.2.7, 9.6.2.3, and 9.7.2.

Which release ranges are affected?