CVE-2026-66835

A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...

CVE-2026-70399

A flaw was found in inets. An unauthenticated remote attacker can exploit a resource allocation vulnerability in the Erlang/OTP inets httpd component. This flaw allows the attacker to cause a denial of service by opening and holding open a large number of connections. The server fails to enforce...

CVE-2026-73276

A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...

Linux Distros Unpatched Vulnerability : CVE-2026-73270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected...

Linux Distros Unpatched Vulnerability : CVE-2026-66835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixin...

Linux Distros Unpatched Vulnerability : CVE-2026-71380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servic...

Linux Distros Unpatched Vulnerability : CVE-2026-69664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servic...

Linux Distros Unpatched Vulnerability : CVE-2026-70399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of servic...

CVE-2026-69664

A flaw was found in Erlang/OTP inets httpd. An unauthenticated remote attacker can exploit this vulnerability by sending a malformed chunked HTTP request. Specifically, if the chunk-size line is not a hexadecimal number and arrives separately from the headers, the server worker handling the reque...

SUSE CVE-2026-66835

Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...

SUSE CVE-2026-69664

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...

SUSE CVE-2026-70399

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

SUSE CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

SUSE CVE-2026-71562

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

SUSE CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

inets: Erlang/OTP inets httpd: Directory protection bypass allows information disclosure

A flaw was found in Erlang/OTP inets httpd. A remote unauthenticated attacker can exploit a path equivalence vulnerability to bypass directory protection. By adding an extra slash to the request path, the attacker can read files within a modauth protected directory. This occurs because the server...

otp: inets: Erlang/OTP inets httpd: Denial of Service via malformed chunked HTTP request

A flaw was found in Erlang/OTP inets httpd. An unauthenticated remote attacker can exploit this vulnerability by sending a malformed chunked HTTP request. Specifically, if the chunk-size line is not a hexadecimal number and arrives separately from the headers, the server worker handling the reque...

CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

AZL-98484 CVE-2026-73270 affecting package erlang for versions less than 26.2.5.21-6

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

DEBIAN-CVE-2026-73812

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...