CVE-2026-66357: erlang otp HTTP Request/Response Smuggling

CVSS: 8.3v4.0HighDeferred

AliasesUBUNTU-CVE-2026-66357DEBIAN-CVE-2026-66357

Published 01-09-2026Last modified 08-09-2026

Vulnerability summary

CVE-2026-66357 is a high (CVSS 8.3) HTTP Request/Response Smuggling vulnerability in erlang otp. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.4% of scored vulnerabilities.

Overall risk

33/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.3/10

010

High · v4.0 (CVE.org)

EPSS score

0.58%

0%100%

Low · +0.25 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

USN-8827-1

Timeline

01-09-2026
PublishedVulnerability first disclosed.
08-09-2026
Last modifiedVulnerability information updated.

Description

httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

CVSS metrics

4 scores · 4 sources · 1 version

v4.08.3

EPSS trend

Probability

0.58%

Chance of exploitation in the next 30 days

Percentile

46%

Versus all other CVEs

30-day change

+0.25 pp

From 0.33% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Debian1 product

erlangAll versions (No fix recorded) | < 1:29.0.6+dfsg-1

Erlang1 product

otp≥ 17.0, < 27.3.4.17 | ≥ 28.0, < 28.5.0.6 | ≥ 29.0, < 29.0.6 | ≥ 5.10, < 9.3.2.7 | ≥ 9.4, < 9.6.2.3 | ≥ 9.7, < 9.7.2 | ≥ 84adefa331c4159d432d22840663c38f155cd4c1 (No fix recorded)

Ubuntu1 product

erlang< 1:16.b.3-dfsg-1ubuntu2.2+esm2 | < 1:18.3-dfsg-1ubuntu3.1+esm3 | < 1:20.2.2+dfsg-1ubuntu2+esm3 | < 1:22.2.7+dfsg-1ubuntu0.5+esm2 | < 1:24.2.1+dfsg-1ubuntu0.7 | < 1:25.3.2.8+dfsg-1ubuntu4.7 | < 1:27.3.4.6+dfsg-1ubuntu0.1

3 vendors · 3 products