CVE-2026-73276inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

Description

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6.2.3, and 9.7.2.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p vendor-advisory
• EEF CNA record for CVE-2026-73276 related
• OSV record EEF-CVE-2026-73276 related
• Erlang/OTP version ordering
• Introducing commit c06db0b in erlang/otp related
• Fix commit 60add5a in erlang/otp patch
• Fix commit 6cd995e in erlang/otp patch
• Fix commit c285240 in erlang/otp patch