Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2026-23941

critical

CVE-2026-23941

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling' ...

Published Modified CWE 444
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Trivy's own label is CRITICAL. Rated critical by NVD, Photon OS. Rated lower by Azure Linux (high), CBL-Mariner (high), Ubuntu (medium).

Description

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5.

Affected packages and fixed versions

SourcePackageFixed in
Photon OS 4.0erlang27.3.4.10-1.ph4
Photon OS 5.0erlang27.3.4.10-1.ph5
Azure Linux 3.0erlang0:26.2.5.18-1.azl3
CBL-Mariner 2.0erlang0:25.3.2.21-5.cm2
debian 11erlang1:23.2.6+dfsg-1+deb11u4
debian 12erlang1:25.2.3+dfsg-1+deb12u4
debian 13erlang1:27.3.4.1+dfsg-1+deb13u2
debian 14erlang1:27.3.4.9+dfsg-1
echoerlang1:25.2.3+dfsg-1+deb12u4
rapidfort alpine 3.20erlang26.2.5.12-r0
rapidfort alpine 3.21erlang26.2.5.12-r0
rapidfort alpine 3.22erlang26.2.5.12-r0
Show all 24 entries from 24 sources
SourcePackageFixed in
Photon OS 4.0erlang27.3.4.10-1.ph4
Photon OS 5.0erlang27.3.4.10-1.ph5
Azure Linux 3.0erlang0:26.2.5.18-1.azl3
CBL-Mariner 2.0erlang0:25.3.2.21-5.cm2
debian 11erlang1:23.2.6+dfsg-1+deb11u4
debian 12erlang1:25.2.3+dfsg-1+deb12u4
debian 13erlang1:27.3.4.1+dfsg-1+deb13u2
debian 14erlang1:27.3.4.9+dfsg-1
echoerlang1:25.2.3+dfsg-1+deb12u4
rapidfort alpine 3.20erlang26.2.5.12-r0
rapidfort alpine 3.21erlang26.2.5.12-r0
rapidfort alpine 3.22erlang26.2.5.12-r0
rapidfort alpine 3.23erlang26.2.5.12-r0
rapidfort alpine 3.24erlang26.2.5.12-r0
rapidfort debian 12erlang0:27.3.4.1+dfsg-1+deb13u2, 1:25.2.3+dfsg-1+deb12u4, 1:27.3.4.9+dfsg-1
rapidfort debian 13erlang0:27.3.4.1+dfsg-1+deb13u2, 1:25.2.3+dfsg-1+deb12u4, 1:27.3.4.9+dfsg-1
rapidfort ubuntu 20.04erlang1:24.2.1+dfsg-1ubuntu0.7, 1:25.3.2.8+dfsg-1ubuntu4.7, 1:27.3.4.6+dfsg-1ubuntu0.1
rapidfort ubuntu 22.04erlang1:24.2.1+dfsg-1ubuntu0.7, 1:25.3.2.8+dfsg-1ubuntu4.7, 1:27.3.4.6+dfsg-1ubuntu0.1
rapidfort ubuntu 24.04erlang1:24.2.1+dfsg-1ubuntu0.7, 1:25.3.2.8+dfsg-1ubuntu4.7, 1:27.3.4.6+dfsg-1ubuntu0.1
ubuntu 18.04-ESMerlang1:20.2.2+dfsg-1ubuntu2+esm3
ubuntu 20.04-ESMerlang1:22.2.7+dfsg-1ubuntu0.5+esm2
ubuntu 22.04erlang1:24.2.1+dfsg-1ubuntu0.7
ubuntu 24.04erlang1:25.3.2.8+dfsg-1ubuntu4.7
ubuntu 26.04erlang1:27.3.4.6+dfsg-1ubuntu0.1

References

All 10 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.