HIGH 8.3 NVD
CVE-2026-73276
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 befor
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
References
- https://cna.erlef.org/cves/CVE-2026-73276.html
- https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683
- https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c
- https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f
- https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-09-01 via NVD.
vulnfeed aggregates 11520 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.