Loading story…
CVE-2026-73812 (also tracked as GHSA-7j6m-4ffg-hg46) is a high-severity HTTP request-smuggling flaw in Erlang/OTP's inets httpd component. Although the server rejects duplicate Content-Length headers, it accepts requests that include both Transfer-Encoding and Content-Length, a combination RFC 9112 identifies as a likely smuggling attempt.
An attacker can exploit this behavior when a Content-Length-preferring frontend proxy forwards requests to an inets backend that prioritizes chunked Transfer-Encoding, creating CL.TE request desynchronization. Erlang/OTP fixed the issue in OTP 27.3.4.17, 28.5.0.6, and 29.0.6, corresponding to inets versions 9.3.2.7, 9.6.2.3, and 9.7.2; the impact on OTP versions earlier than 17.0 is unknown.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Erlang/OTP modified its INETS HTTP server parser to reject obsolete HTTP obs-fold header continuation lines beginning with a space or tab after CRLF. Such requests now receive HTTP 400 with the message "obs-fold not supported," with tests added for space- and tab-prefixed continuations under RFC 9112 section 5.2.
Erlang/OTP changed the INETS HTTP server parser to reject request headers containing whitespace between a field name and its colon, returning HTTP 400 rather than ignoring the invalid header. The change aligns handling with RFC 7230 section 3.2.4 and updates the related HTTP server test.
Erlang/OTP released fixes for CVE-2026-73812 in its inets httpd component in OTP 27.3.4.17, 28.5.0.6, and 29.0.6. The high-severity flaw permits CL.TE request desynchronization when a Content-Length-preferring front end proxies to the chunked-encoding-preferring backend.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
cna.erlef.org
Open sourceosv.dev
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New research and vendor advisories have highlighted a broader class of **HTTP desynchronization and request smuggling** risks driven by parser inconsistencies in headers and chunked encoding. A PortSwigger paper on **CRLF-powered desync attacks** warned that header injection can do far more than trigger open redirects or XSS, enabling attackers to "behead" HTTP streams and create severe front-end/back-end parsing mismatches. Related research on ambiguous chunk line terminators and chunk-extension parsing has shown how subtle differences in HTTP/1.1 handling can be turned into cache poisoning, security-control bypass, unauthorized access, and denial-of-service conditions. Red Hat documented multiple affected implementations under **CWE-444**. **`CVE-2026-33870`** in Netty was rated Important and stems from incorrect parsing of quoted strings in HTTP/1.1 chunked transfer-encoding extension values, with no acceptable mitigation listed beyond product fixes. **`CVE-2024-52304`** in aiohttp affects deployments using the pure Python parser, where newline handling in chunk extensions can let attackers bypass proxies or firewalls. **`CVE-2026-1525`** in Undici allows duplicate `Content-Length` headers through case-variant names, creating malformed requests that can trigger request smuggling or DoS. Supporting tooling such as **smugchunks** has emerged to detect chunk-parsing discrepancies in black-box testing, underscoring that these desync issues are practical and span multiple widely used HTTP stacks.
Aug 20, 2026
A vulnerability in Go's `net/http` package, tracked as **CVE-2025-22871**, can let malformed HTTP messages ending with a lone line feed be accepted instead of the required line ending, creating conditions for **HTTP request smuggling** when traffic is passed to another server that interprets the request differently. The issue affects server-side handling and has drawn differing severity assessments, with **cve.org** listing a **CVSS 9.1** score while **Red Hat** rates impact on its products as **Moderate** with a **CVSS v3 5.4** score. Red Hat said exposure varies by product and noted that **Red Hat Satellite** is considered **Low** severity because it uses the affected Go component only as an HTTP client rather than as a server. The company reported that no acceptable mitigation is currently available under its product security criteria and published fixes for multiple affected packages, including **Cryostat 4 on RHEL 9 components** through advisory **`RHSA-2025:10323`**.
Aug 27, 2026
Erlang/OTP disclosed **CVE-2026-49759**, a high-severity stack buffer overflow in the `inet_drv` SCTP error-cause parsing path that can let an unauthenticated remote attacker crash the BEAM VM. The flaw is in `sctp_parse_error_chunk` in `erts/emulator/drivers/common/inet_drv.c`, where crafted SCTP `ERROR` chunks can overflow a fixed-size stack buffer while cause codes are converted into `ErlDrvTermData` entries. Exploitation requires SCTP support to be enabled, a listening SCTP socket to be exposed through `gen_sctp` using the default `inet` backend, and network reachability to that port; Windows builds are not affected because SCTP is unsupported there. Advisories and the upstream patch indicate the issue is primarily **denial of service**, not expected remote code execution, because stack protections should terminate the process before meaningful control of execution is possible and the overwrite pattern is constrained. A crafted packet may also leak limited Erlang VM memory in an error response. The vulnerability affects OTP releases from **17.0** up to but excluding **27.3.4.13**, **28.5.0.2**, and **29.0.2**. The fix adds bounds checking and truncation safeguards in SCTP parsing and related async-event handling to prevent output term buffer overruns during malformed packet processing.
Jun 29, 2026