CVE-2026-71562

Erlang/OTP inets httpc contains an improper validation flaw where server-supplied Content-Length and Retry-After header values are converted via unbounded list_to_integer/1 before size checks can apply. A malicious HTTP server can return a numeric header with up to roughly 1.26 million digits , c...

CVE-2026-48856

Sensitive Data Exposure vulnerability in Erlang OTP inets httpcresponse module allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary...