CVE-2026-73812: inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length

unknownCVE-2026-73812

CSIRTS triage

vendor: Erlang product: Erlang/OTPOther

What: HTTP request smuggling vulnerability in httpd via conflicting Transfer-Encoding and Content-Length headers.
Who is affected: Erlang/OTP httpd and inets deployments processing HTTP requests from untrusted sources.
Urgency: Severity unknown; request smuggling attacks can bypass security controls and require urgent action.
Action: Upgrade Erlang/OTP to patched version and validate request header handling against HTTP smuggling vectors.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Erlang/OTP

Get an email when a new Erlang/OTP advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-09-02
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-73812

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-738120.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-73812	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for inets, httpd

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-73276: inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping imsrc · 2026-09-02
unknownCVE-2026-74835: inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Receptionmsrc · 2026-09-02
unknownCVE-2026-74994: inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_authmsrc · 2026-09-02
unknownCVE-2026-66357: inets,httpd:HTTP Request Smuggling via obs-fold Header Continuationmsrc · 2026-09-02
unknownCVE-2026-74994: The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentic…nvd · 2026-09-01
unknownCVE-2026-74835: The inets application HTTP server httpd fails to enforce a configured body-size limit on chunk…nvd · 2026-09-01