CVE-2026-73276
Description
A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that tolerates such malformed headers, the httpd server may misinterpret subsequent requests, leading to potential security bypasses or cache poisoning.
Statement
A flaw was found in the Erlang/OTP inets httpd server where HTTP headers containing whitespace between the field-name and colon are silently accepted rather than rejected. When deployed behind a reverse proxy that tolerates such malformed headers, this can lead to HTTP Request Smuggling, allowing attackers to bypass security controls or poison caches.
Red Hat ships Erlang in OpenStack 16.2 (version 23.3.4.18), OpenStack 17.1 (version 24.3.4.2), OpenStack 18.0 (version 26.2.5.21), and EPEL (version 26.2.5), which include versions of the inets library affected by this vulnerability. However, Red Hat products ship Erlang exclusively as a runtime dependency for RabbitMQ, the AMQP message broker used for inter-service messaging.
RabbitMQ does not use the vulnerable inets httpd component; its management plugin and HTTP API use the Cowboy HTTP server instead. The inets httpd server would require explicit configuration via Erlang application settings to be enabled, and there is no evidence that any Red Hat product configures, enables, or exposes this component. The inets library is present only for its HTTP client functionality, not the httpd server module.
Therefore, while the Erlang package versions are technically in the affected range, the vulnerable code path is not reachable in Red Hat's default shipping configurations, resulting in a LOW security impact. Red Hat Hummingbird 1 ships Erlang version 27.3.4.17, which is the fixed version and is not affected.
Mitigation
Update to Erlang/OTP 27.3.4.17, 28.5.0.6, or 29.0.6 or later when updates become available through Red Hat channels. For Red Hat products shipping Erlang (OpenStack 16.2, 17.1, 18.0, EPEL), the vulnerable inets httpd component is not used by default. RabbitMQ uses the Cowboy HTTP server for its management interface, not inets httpd. To verify that inets httpd is not running in your environment, check that no Erlang processes are configured to start the inets httpd server via application configuration files.
If you have custom Erlang applications that explicitly use inets httpd, ensure they are not deployed behind reverse proxies that tolerate malformed HTTP headers, or configure the proxy to strictly reject requests with whitespace between HTTP header field names and colons.
For most Red Hat deployments, no immediate action is required beyond normal update procedures, as the vulnerable component is not exposed.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Understanding the Weakness (CWE)
Integrity,Non-Repudiation,Access Control
Technical Impact: Unexpected State; Hide Activities; Bypass Protection Mechanism
An attacker could create HTTP messages to exploit a number of weaknesses including 1) the message can trick the web server to associate a URL with another URL's webpage and caching the contents of the webpage (web cache poisoning attack), 2) the message can be structured to bypass the firewall protection mechanisms and gain unauthorized access to a web application, and 3) the message can invoke a script or a page that returns client credentials (similar to a Cross Site Scripting attack).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
