CVE-2026-73270 Erlang CVE debrief

Who should care

Defenders of Erlang/OTP deployments with case-insensitive filesystems should assess exposure and prioritize patching. This includes verifying affected versions, checking for case-insensitive filesystems, and applying patches. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and monitor for unauthorized file access.

Why it matters

CVE-2026-73270 is a high-severity vulnerability in Erlang/OTP inets httpd that allows unauthorized file access on case-insensitive filesystems. Defenders should prioritize verifying affected versions, checking for case-insensitive filesystems, and applying patches.

• Verify affected versions of OTP and inets
• Check if the filesystem is case-insensitive
• Apply patches to OTP and inets
• Monitor for unauthorized file access

Technical summary

The Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. This issue arises because mod_auth:secret_path/3 decides whether a resolved filesystem path lies inside a protected directory block by running the configured directory path through re:run/3 without the caseless option. A request for /secret/file against a directory configured as /Secret therefore does not match, so the request is treated as unprotected and no authentication challenge is issued, while the filesystem resolves the differently cased

Defensive priority

Defenders should prioritize verifying affected versions, checking for case-insensitive filesystems, and applying patches.

Recommended defensive actions

• Verify affected versions of OTP and inets
• Check if the filesystem is case-insensitive
• Apply patches to OTP and inets
• Monitor for unauthorized file access
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6. Whether OTP before OTP 17.0 is affected is unknown. The Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. This issue arises because mod_auth:secret_path/3 decides whether a resolved The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.