CVE-2026-73812 Erlang CVE debrief

Who should care

Defenders responsible for configuring and securing HTTP services, particularly those using OTP versions from 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6, should assess their exposure to this vulnerability.

Why it matters

CVE-2026-73812 is a vulnerability in the httpd function of an unknown vendor's product, potentially allowing for HTTP desynchronization. Defenders should prioritize verifying exposure in their HTTP configurations and applying patches or mitigations as available. The vulnerability affects OTP versions from 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6.

• Potential HTTP desynchronization attempts
• Verification of exposure in HTTP configurations
• Application of patches or mitigations as available
• Monitoring for potential desynchronization attempts

Technical summary

The httpd function check_header/3 rejects duplicate Content-Length headers but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync. This vulnerability affects OTP versions from 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Defensive priority

Defenders should prioritize verifying exposure in their HTTP configurations and applying patches or mitigations as available.

Recommended defensive actions

• Verify exposure in HTTP configurations
• Apply patches or mitigations as available
• Monitor for potential desynchronization attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the affected vendor and product names are not specified. The Erlef CNA has provided additional information on the vulnerability. Defenders should verify exposure in their HTTP configurations and apply patches or mitigations as available. The vulnerability affects OTP versions from 17.0 before 27.3.4.17, from 28.0 before 28.5.0.6, and from 29.0 before 29.0.6. Evidence limits suggest further verification is needed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.