CVE-2026-73812 Erlang CVE debrief

Who should care

Defenders and administrators of systems using Erlang OTP and inets should assess their exposure and take necessary actions to mitigate this vulnerability. This includes reviewing configurations, applying patches, and monitoring for potential attacks.

Why it matters

CVE-2026-73812 is a vulnerability in Erlang OTP's inets component that can lead to HTTP request smuggling. Defenders should assess exposure, apply patches, and monitor for potential attacks.

• Potential for HTTP request smuggling attacks.
• Exposure of systems using Erlang OTP and inets to desync attacks.
• Need for verification of affected versions and application of patches or mitigations.
• Potential disruption of service if exploited.

Technical summary

The vulnerability arises from the improper handling of duplicate Content-Length headers and the co-presence of TE and CL in the Erlang OTP inets component. This can lead to a classic CL.TE front-end/back-end desync, allowing for potential HTTP request smuggling attacks. The issue affects OTP versions from 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6, corresponding to inets versions from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Defenders should prioritize patching or mitigating this vulnerability, especially in systems where OTP is used in conjunction with inets, to prevent potential HTTP request smuggling attacks.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in systems where OTP is used in conjunction with inets, to prevent potential HTTP request smuggling attacks.

Recommended defensive actions

• Assess exposure and apply patches or updates to OTP and inets to the latest versions.
• Review and update configurations to ensure that front-end and back-end systems are properly aligned.
• Monitor for potential HTTP request smuggling attacks.
• Verify that compensating controls are in place for systems that cannot be patched immediately.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and references to source-specific vulnerability assessments. The vulnerability affects OTP versions from 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6, corresponding to inets versions from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Defenders should verify the affected scope and apply patches or mitigations accordingly.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.