CVE-2026-73276

inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i

High8.3EPSS 0.58%

Published: 1 Sept 2026
Updated: 8 Sept 2026
Reserved: 12 Aug 2026
Assigned by: EEF

Description

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Scores

CVSS scores of CVE-2026-73276, by who scored it
Scored by	CVSS	Score	Vector
EEFCNA (assigner)	4.0	High8.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
NVDNVD · Deferred	4.0	High8.3	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.58% · top 52% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.

Weakness

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (opens in a new tab)All about CWE-444 and its CVEs

Affected products

Erlang · OTP
- affected 22.2 – < 27.3.4.17
- affected 28.0 – < 28.5.0.6
- affected 29.0 – < 29.0.6
Erlang · OTP
- affected 7.1.2 – < 9.3.2.7
- affected 9.4 – < 9.6.2.3
- affected 9.7 – < 9.7.2
Erlang · OTP
- affected c06db0bedf49a9b40725745e73fa82e562612815 – < *

References (6)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-73276](https://trackcve.app/badge/CVE-2026-73276.svg)](https://trackcve.app/cve/CVE-2026-73276)

Record last updated 8 Sept 2026, 01:10 UTC.