---
id: CVE-2026-73812
title: >-
  httpd function check_header/3 rejects duplicate Content-Length (per
  CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3
  identifies as a probable smuggling attempt
summary: >-
  httpd function check_header/3 rejects duplicate Content-Length (per
  CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3
  identifies as a probable smuggling attempt. handle_body/3 frames by chunked
  and silently di…
severity: high
cvss: 8.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-444
vendor: Erlang
product: otp
affected:
  - otp >= 17.0 < 27.3.4.17
  - otp >= 28.0 < 28.5.0.6
  - otp >= 29.0 < 29.0.6
  - inets >= 5.10 < 9.3.2.7
  - inets >= 9.4 < 9.6.2.3
  - inets >= 9.7 < 9.7.2
  - >-
    erlang/otp >= 84adefa331c4159d432d22840663c38f155cd4c1 <
    591dc00dc99dc2a426167a3b5257c0c94bd45e91
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T01:17:54.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73812'
references:
  - url: 'https://cna.erlef.org/cves/CVE-2026-73812.html'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://github.com/erlang/otp/commit/591dc00dc99dc2a426167a3b5257c0c94bd45e91
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://github.com/erlang/otp/security/advisories/GHSA-7j6m-4ffg-hg46'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: 'https://osv.dev/vulnerability/EEF-CVE-2026-73812'
    label: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73812.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-73812'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2526827'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-73812'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73812'
  - url: 'https://access.redhat.com/errata/RHSA-2026:62531'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-01T15:56:32.935740Z'
cvssSource: cna
epss: 0.00524
epssPercentile: 0.42004
ingestedAt: '2026-09-08T15:33:26.957Z'
patched:
  - hardened_images
scores:
  cna: 8.3
  vendor: 8.2
---

## Overview

httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:62531** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62531)
- **Red Hat VEX** · Important · affected: Red Hat OpenShift Dev Spaces · no fix planned: Red Hat OpenShift Dev Spaces · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73812.json)