Description
httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, 9.6.2.3, and 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Erlang | OTP | 17.0, 5.10 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | erlang | 1:29.0.6+dfsg-1 | — |
| Debian 13 | erlang | 1:27.3.4.1+dfsg-1+deb13u4 | — |
| Debian 12 | erlang | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | erlang | 1:27.3.4.6+dfsg-1ubuntu0.1 | USN-8827-1 |
| Ubuntu 24.04 LTS | erlang | 1:25.3.2.8+dfsg-1ubuntu4.7 | USN-8827-1 |
| Ubuntu 22.04 LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.7 | USN-8827-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | erlang | 1:22.2.7+dfsg-1ubuntu0.5+esm2 | USN-8827-1 |
| Ubuntu Pro 18.04 LTS | erlang | 1:20.2.2+dfsg-1ubuntu2+esm3 | USN-8827-1 |
| Ubuntu Pro 16.04 LTS | erlang | 1:18.3-dfsg-1ubuntu3.1+esm3 | USN-8827-1 |
| Ubuntu Pro 14.04 LTS | erlang | 1:16.b.3-dfsg-1ubuntu2.2+esm2 | USN-8827-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | erlang | 26.2.5.21-6 | — |
Advisories 2
- WID-SEC-2026-3146 Erlang/OTP: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- USN-8827-1 erlang vulnerabilities Ubuntu Security Notices (USN) · Sep 28, 2026
References
- https://github.com/erlang/otp/security/advisories/GHSA-qh2f-33hj-37qf vendor-advisory
- EEF CNA record for CVE-2026-66357 related
- OSV record EEF-CVE-2026-66357 related
- Erlang/OTP version ordering
- Fix commit 220d618 in erlang/otp patch
- Fix commit 273d895 in erlang/otp patch
- Fix commit e640d59 in erlang/otp patch