The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | Oct 28, 2026 | Sep 1, 2026 |
| Freebsd | — | Upgrade erlang-runtime27Upgrade erlangUpgrade erlang-runtime29Upgrade erlang-runtime28 | Sep 2, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade erlang-eldap (Ubuntu Pro)Upgrade erlang-sslUpgrade erlang-inets (Ubuntu Pro)Upgrade erlang-megacoUpgrade erlang-eldapUpgrade erlang-megaco (Ubuntu Pro)Upgrade erlang-base (Ubuntu Pro)Upgrade erlang-base-hipe (Ubuntu Pro)Upgrade erlang-ssl (Ubuntu Pro)Upgrade erlang-snmpUpgrade erlang-inetsUpgrade erlang-snmp (Ubuntu Pro)Upgrade erlang-baseUpgrade erlang-public-key | Sep 29, 2026 | Sep 28, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub