httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade erlang-runtime27Upgrade erlang-runtime29Upgrade erlangUpgrade erlang-runtime28 | Sep 2, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade erlang-inets (Ubuntu Pro)Upgrade erlang-ssl (Ubuntu Pro)Upgrade erlang-sslUpgrade erlang-eldap (Ubuntu Pro)Upgrade erlang-base (Ubuntu Pro)Upgrade erlang-megacoUpgrade erlang-base-hipe (Ubuntu Pro)Upgrade erlang-megaco (Ubuntu Pro)Upgrade erlang-eldapUpgrade erlang-public-keyUpgrade erlang-inetsUpgrade erlang-snmp (Ubuntu Pro)Upgrade erlang-baseUpgrade erlang-snmp | Sep 29, 2026 | Sep 28, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub