Erlang/OTP: 16 Vulnerabilities Disclosed, Targeting HTTP Handling and Resource Management
Key findings • 16 vulnerabilities disclosed simultaneously for Erlang/OTP on September 1, 2026. • Multiple high-severity flaws in inets httpd related to HTTP request smuggling and DoS. • …
Key findings
- 16 vulnerabilities disclosed simultaneously for Erlang/OTP on September 1, 2026.
- Multiple high-severity flaws in inets httpd related to HTTP request smuggling and DoS.
- Buffer overflow in inet driver (CVE-2026-75538) and path traversal in mod_auth disclosed.
- Improper input validation in httpc, eldap, and snmp can lead to availability degradation.
- Affected versions span a wide range; prompt patching is essential.
On September 1, 2026, a significant batch of 16 vulnerabilities was disclosed for Erlang/OTP, impacting various components including the inets HTTP server, httpd, httpc, eldap, and snmp modules. These vulnerabilities, ranging in severity from Medium to High, were all disclosed on the same day, indicating a coordinated disclosure event. The issues primarily revolve around improper input validation, resource management, and handling of HTTP protocols, with several leading to potential denial-of-service conditions or request smuggling opportunities.
Several vulnerabilities in the inets HTTP server (httpd) and httpc client are related to the handling of HTTP requests and responses. CVE-2026-73812, CVE-2026-73276, and CVE-2026-66357 highlight issues with HTTP request smuggling, stemming from improper handling of headers like Content-Length and chunked transfer encoding. CVE-2026-74835 and CVE-2026-69664 detail how httpd fails to enforce body size limits on chunked requests and mishandles chunked encoding, respectively, potentially leading to resource exhaustion or denial of service. CVE-2026-71380 and CVE-2026-11, specifically CVE-2026-70399, address denial-of-service risks through resource exhaustion by allowing an excessive number of open connections or by not properly releasing resources when handling malformed chunked requests.
Further vulnerabilities in the inets httpd component include CVE-2026-75538, a critical buffer overflow vulnerability in the inet driver's packet length calculation when using {packet,4} mode, which could allow an attacker to overwrite memory. CVE-2026-73270 and CVE-2026-66835 expose a path equivalence vulnerability in mod_auth, allowing unauthenticated attackers to read files within protected directories by exploiting case sensitivity or path normalization issues on certain file systems. CVE-2026-74994 describes an authentication bypass in mod_auth when using multiple directory configurations with DETS or Mnesia backends.
Beyond the httpd server, other Erlang/OTP components are also affected. CVE-2026-71562, CVE-2026-70409, CVE-2026-70405, and CVE-2026-59696 all fall under the category of improper validation of quantity in input. These vulnerabilities affect the httpc client, eldap, and snmp modules, respectively. They allow attackers to degrade availability by sending excessively long numeric values in headers or protocol fields, overwhelming parsing functions like list_to_integer/1 or binary_to_integer/1. Finally, CVE-2026-55951 in the httpc client allows a malicious server to cause a denial of service by sending excessively large response headers, as no limit is enforced by default.
The affected versions span a wide range, with specific details provided for OTP and inets versions in the descriptions of CVE-2026-74835, CVE-2026-73276, and CVE-2026-66357. Users are advised to consult the official Erlang/OTP advisories for precise version information and patching details. Given the nature of these vulnerabilities, particularly those related to request smuggling and denial of service, prompt patching is strongly recommended to mitigate potential exploitation.
This coordinated disclosure highlights ongoing security challenges within widely used network protocols and server components. The breadth of affected modules underscores the importance of regular security audits and timely updates for the Erlang/OTP platform, which is a foundational technology for many high-availability systems. Users should prioritize updating to patched versions to protect against these newly revealed weaknesses.