33 matches found
CVE-2026-73270
Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...
CVE-2026-73276
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...
CVE-2026-73812
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
CVE-2026-71380
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...
CVE-2026-71562
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...
CVE-2026-70399
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...
CVE-2026-69664
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...
CVE-2026-69664
Erlang/OTP inets httpd contains a Missing Release of Resource after Effective Lifetime flaw that allows an unauthenticated remote attacker to cause denial of service. The root cause is in how httpd_request_handler:handle_info/2 handles a malformed chunk-size line arriving in a separate write from...
EUVD-2026-69381
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...
EUVD-2026-69245
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
CVE-2026-66835 httpd mod_auth directory protection bypassed by a doubled slash in the request path
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by prefixing the request path with an extra slash. httpdrequest:validateuri/1 normalises the request URI with uristring:normalize/1, which performs...
CVE-2026-66835
A Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra (doubled) slash. The root cause is that uri_string:normalize/1 performs RFC 3986 dot-segment removal ...
CVE-2026-73270 httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...
CVE-2026-73270
Erlang/OTP inets httpd contains an improper handling of case sensitivity flaw in mod_auth:secret_path/3 , which matches a request path against a configured protected directory using re:run/3 without the caseless option . On case-insensitive filesystems , a request for /secret/file against a direc...
EUVD-2026-69243
Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...
EUVD-2026-69235
httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...
EUVD-2026-69233
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...
CVE-2026-66357 inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...
CVE-2026-71380
CVE-2026-71380 is a Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd . An unauthenticated remote attacker can trigger a denial of service by sending valid request headers declaring a large Content-Length and then stalling before the body is complete. In...
EUVD-2026-69226
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...