CVE-2026-66835 Erlang CVE debrief

Who should care

Defenders and administrators of systems using Erlang/OTP inets httpd, particularly those with mod_auth protected directories, should assess exposure and prioritize patching affected versions.

Why it matters

CVE-2026-66835 is a Path Equivalence vulnerability in Erlang/OTP inets httpd that allows remote unauthenticated attackers to read files inside mod_auth protected directories. Defenders should prioritize verifying and applying patches for affected OTP versions and assess exposure in their environments.

• Remote unauthenticated attackers can read files inside mod_auth protected directories
• Affected OTP versions require verification and patching
• Exposure assessment is necessary for environments using affected OTP and inets versions
• Monitoring for potential exploitation attempts is recommended

Technical summary

The httpd_request:validate_uri/1 function normalizes the request URI but does not collapse empty path segments, allowing a doubled slash to survive. This breaks the contiguous substring needed for mod_auth:secret_path/3 to decide whether the request lies inside a protected directory block, enabling remote unauthenticated attackers to read protected files. The vulnerability is caused by the httpd_request:validate_uri/1 function not collapsing empty path segments, allowing a doubled slash to survive and break the contiguous substring needed for the mod_auth:secret_path/3 function to decide whether the request lies inside a protected directory block. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from

Defensive priority

Defenders should prioritize verifying and applying patches for affected OTP versions, specifically those in the ranges of OTP 17.0 to OTP 27.3.4.17, OTP 28.0 to OTP 28.5.0.6, and OTP 29.0 to OTP 29.0.6, as well as updating inets to versions 5.10 to 9.3.2.7, 9.4 to 9.6.2.3, or 9.7 to 9.7.2, and assess exposure in their environments.

Recommended defensive actions

• Verify and apply patches for affected OTP versions
• Update inets to the latest secure version
• Assess exposure in environments using affected OTP and inets versions
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the httpd_request:validate_uri/1 function not collapsing empty path segments, allowing a doubled slash to survive and break the contiguous substring needed for the mod_auth:secret_path/3 function to decide whether the request lies inside a protected directory block.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.