CVE-2026-73276
published 2026-09-01CVE-2026-73276: Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2…
PriorityP348high8.3CVSS 4.0
AVNACLATPPRNUINVCLVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.58%
46.8th percentile
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cryostat | cryostat-storage-rhel9 | — | — |
| devspaces | traefik-rhel9 | — | — |
| erlang | otp | >= 22.2 < 27.3.4.17 | 27.3.4.17 |
| erlang | otp | >= 28.0 < 28.5.0.6 | 28.5.0.6 |
| erlang | otp | >= 29.0 < 29.0.6 | 29.0.6 |
| erlang | otp | >= 7.1.2 < 9.3.2.7 | 9.3.2.7 |
| erlang | otp | >= 9.4 < 9.6.2.3 | 9.6.2.3 |
| erlang | otp | >= 9.7 < 9.7.2 | 9.7.2 |
| erlang | otp | >= c06db0bedf49a9b40725745e73fa82e562612815 < * | * |
| rhacm2 | volsync-rhel9 | — | — |
| ubuntu | erlang | — | — |
CVSS provenance
nvdv4.08.3HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.3HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Erlang vulnerabilities
vendor_ubuntu·2026-09-28·CVSS 7.5
CVE-2026-23941 [HIGH] Erlang vulnerabilities
Title: Erlang vulnerabilities
Summary: Several security issues were fixed in Erlang.
It was discovered that the Erlang Port Mapper Daemon did not properly
handle slow connections. A remote attacker could possibly use this issue
to cause a denial of service. (CVE-2026-42792)
It was discovered that Erlang incorrectly handled certain external term
format data, leading to heap corruption. An attacker could possibly use
this issue to cause Erlang to crash, resulting in a denial of service.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS.
(CVE-2026-55737)
It was discovered that Erlang incorrectly handled invalid external term
format data. An attacker could possibly use this issue to cause Erlang to
crash, resulting in a denial of service. This issue only affected Ubuntu
26.04
Red Hat
otp: inets: OTP inets httpd: HTTP Request Smuggling vulnerability via malformed headers
vendor_redhat·2026-09-01·CVSS 8.3
CVE-2026-73276 [HIGH] CWE-444 otp: inets: OTP inets httpd: HTTP Request Smuggling vulnerability via malformed headers
otp: inets: OTP inets httpd: HTTP Request Smuggling vulnerability via malformed headers
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that tolerates such malformed headers, the httpd server may misinterpret
No detection rules found.
No public exploits indexed.
https://cna.erlef.org/cves/CVE-2026-73276.htmlhttps://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820chttps://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0fhttps://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8phttps://osv.dev/vulnerability/EEF-CVE-2026-73276
2026-09-01
Published