CVE-2026-66357: inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation

unknownCVE-2026-66357

CSIRTS triage

vendor: Erlang/OTP product: inets httpdOther

What: HTTP request smuggling vulnerability in httpd via obs-fold header continuation allows crafted requests to bypass validation.
Who is affected: Deployments of Erlang/OTP inets httpd receiving HTTP requests with non-standard header folding.
Urgency: High urgency as request smuggling can enable cache poisoning, session hijacking, or security control bypass.
Action: Update Erlang/OTP to a patched version addressing CVE-2026-66357.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch inets httpd

Get an email when a new inets httpd advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-09-02
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-66357

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-663570.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-66357	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for inets,httpd

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-73276: inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping imsrc · 2026-09-02
unknownCVE-2026-74994: inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_authmsrc · 2026-09-02
unknownCVE-2026-74835: inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Receptionmsrc · 2026-09-02
unknownCVE-2026-73812: inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Lengthmsrc · 2026-09-02
unknownCVE-2026-74994: The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentic…nvd · 2026-09-01
unknownCVE-2026-73270: Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote …nvd · 2026-09-01