HTTP Request Smuggling Vulnerability in Erlang/OTP
CVE-2026-73276

8.3HIGH

Key Information:

Vendor

Erlang

Status
Otp
Vendor
CVE Published:
1 September 2026

What is CVE-2026-73276?

A vulnerability in Erlang/OTP affects versions prior to specified patches where certain scenarios are mishandled, allowing HTTP Request Smuggling attacks. This flaw occurs due to a failure to correctly reject certain gracefully handled cases, posing risks to data integrity and application security. It is important to update to the latest versions to ensure that systems are protected from potential exploitation.

Affected Version(s)

OTP 22.2 < 27.3.4.17

OTP 28.0 < 28.5.0.6

OTP 29.0 < 29.0.6

References

https://github.com/erlang/otp/security/advisories/GHSA-6v...
vendor-advisory
https://cna.erlef.org/cves/CVE-2026-73276.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-73276
related

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Konrad Pietrzak / Ericsson
Lukas Backström / Erlang Solutions
.