CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-74835

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...

DEBIAN-CVE-2026-73812

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

DEBIAN-CVE-2026-73276

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...

AZL-98493 CVE-2026-74835 affecting package erlang for versions less than 26.2.5.21-6

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...

AZL-98490 CVE-2026-73812 affecting package erlang for versions less than 26.2.5.21-6

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

AZL-98484 CVE-2026-73270 affecting package erlang for versions less than 26.2.5.21-6

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

CVE-2026-73276

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...

CVE-2026-73812

httpd function checkheader/3 rejects duplicate Content-Length per CVE-2026-23941 but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handlebody/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with...

DEBIAN-CVE-2026-73270

Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a modauth protected directory by requesting them with different casing, on deployments whose filesystem is case-insensitive. modauth:secretpath/3 decides...

AZL-98496 CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

DEBIAN-CVE-2026-74835

The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4...

AZL-98478 CVE-2026-71380 affecting package erlang for versions less than 26.2.5.21-6

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

AZL-98481 CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-71562

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

DEBIAN-CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

CVE-2026-70399

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

DEBIAN-CVE-2026-69664

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never...

AZL-98460 CVE-2026-66357 affecting package erlang for versions less than 26.2.5.21-6

httpd has never implemented obs-fold RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue...