CVE-2026-66357 Erlang CVE debrief

Who should care

Defenders and administrators responsible for Erlang OTP inets component systems, especially those where HTTP request smuggling attacks are a concern, should assess exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-66357 is a vulnerability in the Erlang OTP inets component that affects HTTP request smuggling. Defenders should prioritize patching or mitigating this vulnerability, especially in systems where HTTP request smuggling attacks are a concern. The exact impact and exploitation status are unclear, and further verification is required.

• Potential HTTP request smuggling attacks
• Need to verify and patch affected OTP versions
• Possible impact on system security and integrity
• Requires review of inventory and potential mitigation

Technical summary

The vulnerability is caused by the missing implementation of obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines) in the Erlang OTP inets component. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. The issue affects OTP from version 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6. Defenders should prioritize patching or mitigating this vulnerability, especially in systems where HTTP request smuggling attacks are a concern.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems where HTTP request smuggling attacks are a concern.

Recommended defensive actions

• Assess exposure and prioritize patching for OTP versions 17.0 to 27.3.4.16, 28.0 to 28.5.0.5, and 29.0 to 29.0.5
• Review and update inventory to identify and mitigate potential vulnerabilities in inets
• Monitor for potential HTTP request smuggling attacks
• Verify vendor remediation and apply compensating controls if necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, the exact impact and exploitation status are unclear. Defenders should verify and patch affected OTP versions, review and update inventory to identify and mitigate potential vulnerabilities in inets, and monitor for potential HTTP request smuggling attacks. The CVE record was published on 2026-09-01T15:17:23.047Z and has not been modified since then. There is no information on known ransomware campaign use.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.