Content-Length and TE Co-Presence Vulnerability in Erlang's OTP Product
CVE-2026-73812

8.3HIGH

Key Information:

Vendor

Erlang

Status
Otp
Vendor
CVE Published:
1 September 2026

What is CVE-2026-73812?

A vulnerability in Erlang's OTP affects the handling of HTTP headers. The function check_header/3 incorrectly rejects duplicate Content-Length headers without checking for the co-presence of Transfer-Encoding (TE), which could signal an attempt at HTTP smuggling. Additionally, handle_body/3 processes data in chunks while silently discarding Content-Length. This misalignment can cause desynchronization issues between front-end and back-end systems where a Content-Length-preferring front-end operates alongside a chunked-preferring handler.

Affected Version(s)

OTP 17.0 < 27.3.4.17

OTP 28.0 < 28.5.0.6

OTP 29.0 < 29.0.6

References

https://github.com/erlang/otp/security/advisories/GHSA-7j...
vendor-advisory
https://cna.erlef.org/cves/CVE-2026-73812.html
related
https://osv.dev/vulnerability/EEF-CVE-2026-73812
related

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Konrad Pietrzak / Ericsson
Lukas Backström / Erlang Solutions
.