CVE-2026-23941

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy) honor the last Content-Length value. This violates RFC 9112 Section 6.3 and allows front-end/back-end desynchronization, leaving attacker-controlled bytes queued as the start of the next request. This issue affects OTP from OTP 17.0 before OTP 28.4.1, OTP 27.3.4.9 and OTP 26.2.5.18, corresponding to inets from 5.10 before 9.6.1, 9.3.2.3 and 9.1.0.5.

• CWE-444

• https://cna.erlef.org/cves/CVE-2026-23941.htmlVendor Advisory
• https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18Patch
• https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45bPatch
• https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6Patch
• https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-23941Third Party Advisory
• https://www.erlang.org/doc/system/versions.html#order-of-versionsProduct

Published

Mar 13, 2026

Last Modified

Jul 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23935A Zabbix administrator is able to read out of bounds memory …4.9
• CVE-2026-23937The Zabbix API host.get action can be exploited by authentic…6.5
• CVE-2026-23938An authenticated administrator is able to crash Zabbix serve…4.9
• CVE-2026-23939Improper Limitation of a Pathname to a Restricted Directory …7.5
• CVE-2026-2394Buffer Over-read vulnerability in RTI Connext Professional (…6.5
• CVE-2026-23940Uncontrolled Resource Consumption vulnerability in hexpm hex…6.5
• CVE-2026-23942Improper Limitation of a Pathname to a Restricted Directory …5.4
• CVE-2026-23943Improper Handling of Highly Compressed Data (Compression Bom…5.3
• CVE-2026-23944Arcane is an interface for managing Docker containers, image…9.8
• CVE-2026-23946Tendenci is an open source content management system built f…6.8
• CVE-2026-23947Orval generates type-safe JS clients (TypeScript) from any v…9.8
• CVE-2026-23948FreeRDP is a free implementation of the Remote Desktop Proto…7.5