Security readout for executives and security teams
Plain-English summary
Erlang OTP’s inets HTTP server can disagree with common reverse proxies about requests containing duplicate Content-Length headers. That disagreement may let an unauthenticated remote attacker confuse request boundaries, potentially affecting other users’ requests or downstream services. Exploitation requires a suitable proxy and persistent-connection setup, so exposure depends heavily on deployment architecture.
Executive priority
Prioritize internet-facing inets deployments behind reverse proxies for prompt assessment and upgrading. Treat confirmed vulnerable proxy-to-inets paths as high priority because attacks require no authentication and may cross user request boundaries. The absence of reported active exploitation lowers immediate crisis urgency but does not remove material risk.
Technical view
Inets httpd_request:parse_headers/7 uses the first Content-Length value without rejecting duplicates, while nginx, Apache httpd, and Envoy commonly use the last. This parser discrepancy can desynchronize front-end and back-end connections, treating queued attacker-controlled bytes as another request. The issue is CWE-444 with CVSS 4.0 score 7.0.
Likely exposure
Highest risk applies where affected inets httpd versions receive traffic through a reverse proxy that interprets duplicate Content-Length differently and reuses backend connections. Directly exposed servers or deployments without persistent intermediary connections may have lower practical risk, but the sources do not establish them as safe.
Exploitation context
The supplied record does not report known active exploitation and states the CVE is not in KEV. Exploitation is network-accessible without privileges or user interaction, but requires particular deployment conditions and high attack complexity. Successful desynchronization could affect confidentiality, integrity, and availability of downstream requests.
Researcher notes
The affected logic is identified in lib/inets/src/http_server/httpd_request.erl, specifically httpd_request:parse_headers/7. The defect violates RFC 9112 Section 6.3 by accepting ambiguous duplicate Content-Length fields. The supplied version metadata is somewhat inconsistent, so validate branch-specific applicability against the vendor advisory and commits.
Mitigation direction
- Upgrade OTP to 28.4.1, 27.3.4.9, 26.2.5.18, or an applicable later supported release.
- Confirm the corresponding inets version is at least 9.6.1, 9.3.2.3, or 9.1.0.5 for its branch.
- Review the Erlang advisory and referenced patches before applying any branch-specific backport.
- Until upgraded, reject requests containing duplicate Content-Length headers at every reachable proxy or gateway.
Validation and detection
- Inventory OTP and inets versions on every system running the inets httpd module.
- Map reverse proxies, backend connection reuse, and request-routing paths in front of affected servers.
- Verify duplicate Content-Length requests are rejected consistently at both intermediary and backend layers.
- After upgrading, run regression tests confirming ambiguous requests are rejected rather than parsed using either header.
- Review proxy and application logs for malformed duplicate Content-Length requests and unexplained request-boundary anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23941 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L——EEFVulnerability scoring details
Base CVSS 4.0 score
7HighVector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7CVE reference, EEF · vendor-advisory, related
- https://cna.erlef.org/cves/CVE-2026-23941.htmlCVE reference, EEF · related
- https://osv.dev/vulnerability/EEF-CVE-2026-23941CVE reference, EEF · related
- https://www.erlang.org/doc/system/versions.html#order-of-versionsCVE reference, EEF · x_version-scheme
- https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18CVE reference, EEF · patch
- https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45bCVE reference, EEF · patch
- https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6CVE reference, EEF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.