---
id: CVE-2026-73276
title: "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\_22.2 before OTP\_27.3.4.17, from OTP\_28.0 before OTP\_28.5.0.6, and from OTP\_29.0 before …"
summary: "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\_22.2 before OTP\_27.3.4.17, from OTP\_28.0 before OTP\_28.5.0.6, and from OTP\_29.0 before …"
severity: high
cvss: 8.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-444
vendor: Erlang
product: otp
affected:
  - otp >= 22.2 < 27.3.4.17
  - otp >= 28.0 < 28.5.0.6
  - otp >= 29.0 < 29.0.6
  - inets >= 7.1.2 < 9.3.2.7
  - inets >= 9.4 < 9.6.2.3
  - inets >= 9.7 < 9.7.2
  - erlang/otp >= c06db0bedf49a9b40725745e73fa82e562612815 < *
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T01:17:53.980'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73276'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-73276.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-73276'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73276.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-73276'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2526829'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-73276'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73276'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-01T15:55:23.919951Z'
cvssSource: cna
epss: 0.00328
epssPercentile: 0.26037
ingestedAt: '2026-09-08T15:33:26.957Z'
scores:
  cna: 8.3
  vendor: 5.4
---

## Overview

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.

This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Dev Spaces · no fix planned: Cryostat 4, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Dev Spaces · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73276.json)