Bug 2526840 (CVE-2026-66357)
| Summary: | CVE-2026-66357 otp: inets: Erlang/OTP inets: HTTP Request Smuggling via improper header parsing | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the `inets` component of Erlang/OTP, specifically within its `httpd` server. This vulnerability arises from the `httpd` server's failure to correctly implement `obs-fold` (obsolete line folding) for HTTP header continuation lines, as defined in RFC 2616 and RFC 7230. This oversight allows a remote attacker to perform HTTP Request Smuggling attacks by crafting malicious HTTP requests. Such attacks can lead to bypassing security mechanisms, poisoning web caches, or gaining unauthorized access to sensitive information when `httpd` is deployed behind a reverse proxy.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-09-01 15:06:58 UTC
|