CVE-2016-1000107: inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect ap...

Security readout for executives and security teams

This is an httpoxy-class weakness in Erlang inets. A client can send a crafted Proxy header that may become an HTTP_PROXY environment variable, causing vulnerable applications to route their own outbound HTTP requests through an attacker-chosen proxy. Exposure is most likely in public HTTP services using Erlang inets where request headers can influence environment variables and the application later performs outbound HTTP calls. Treat as a targeted exposure review rather than an emergency unless inets is internet-facing and performs sensitive outbound HTTP requests. No active exploitation is cited in the provided sources. Mitigation focus: Check Erlang/OTP and distribution guidance for CVE-2016-1000107.; Update inets/Erlang where a vendor-supported fixed version is available.; Strip or reject inbound Proxy headers before application environment processing..

Prepared

Jun 6, 2026, 03:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.