Description
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | erlang | 1:27.3.4.3+dfsg-1 | — |
| Debian 13 | erlang | 1:27.3.4.1+dfsg-1+deb13u1 | — |
| Debian 12 | erlang | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | erlang | No fix yet | — |
| Ubuntu Pro 14.04 LTS | erlang | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | erlang | 28.1.1-1.1 | openSUSE-SU-2025:15706-1 |
Advisories 2
- openSUSE-SU-2025:15706-1 erlang-28.1.1-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2522 Mehrere Webserver: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 10, 2025