CVE-2026-66357

published 2026-09-01

CVE-2026-66357: httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally…

Priority P3 49 high 8.3 CVSS 4.0

AV N AC L AT P PR N UI N VC L VI H VA N SC N SI L SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
erlang	otp	>= 17.0 < 27.3.4.17	27.3.4.17
erlang	otp	>= 28.0 < 28.5.0.6	28.5.0.6
erlang	otp	>= 29.0 < 29.0.6	29.0.6
erlang	otp	>= 5.10 < 9.3.2.7	9.3.2.7
erlang	otp	>= 84adefa331c4159d432d22840663c38f155cd4c1 < *	*
erlang	otp	>= 9.4 < 9.6.2.3	9.6.2.3
erlang	otp	>= 9.7 < 9.7.2	9.7.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-444