CVE-2026-73270 Erlang CVE debrief

Who should care

Defenders responsible for Erlang/OTP and inets deployments, particularly those with case-insensitive filesystems, should assess exposure and apply patches or mitigations. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify affected versions, assess exposure, and apply patches or mitigations to prevent exploitation.

Why it matters

CVE-2026-73270 is a high-severity vulnerability in Erlang/OTP inets httpd that allows remote unauthenticated attackers to read files inside mod_auth protected directories on case-insensitive filesystems. Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or mitigations.

• Verify affected versions and assess exposure
• Apply patches or mitigations to prevent exploitation
• Monitor for potential exploitation attempts

Technical summary

The Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Defensive priority

Defenders should prioritize verifying affected versions, assessing exposure, and applying patches or mitigations.

Recommended defensive actions

• Verify affected versions of Erlang/OTP and inets
• Assess exposure and apply patches or mitigations
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and references. The vulnerability is caused by the improper handling of case sensitivity in Erlang/OTP inets httpd, which allows remote unauthenticated attackers to read files inside mod_auth protected directories on case-insensitive filesystems. The issue affects multiple versions of OTP and inets, and defenders should verify affected versions, assess exposure, and apply patches or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.