336 lines
14 KiB
JSON
336 lines
14 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-73276",
|
||
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "EEF",
|
||
"dateReserved": "2026-08-12T20:00:01.107Z",
|
||
"datePublished": "2026-09-01T14:41:24.565Z",
|
||
"dateUpdated": "2026-11-11T13:44:01.526Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"cpes": [
|
||
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "otp",
|
||
"packageURL": "pkg:software-id/erlang.org/otp",
|
||
"product": "OTP",
|
||
"vendor": "Erlang",
|
||
"versions": [
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "27.3.4.17",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "28.5.0.6",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "29.0.6",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "*",
|
||
"status": "affected",
|
||
"version": "22.2",
|
||
"versionType": "otp"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"cpes": [
|
||
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "inets",
|
||
"packageURL": "pkg:otp/inets?repository_url=https:%2F%2Fgithub.com%2Ferlang%2Fotp&vcs_url=git%2Bhttps:%2F%2Fgithub.com%2Ferlang%2Fotp.git",
|
||
"product": "OTP",
|
||
"repo": "https://github.com/erlang/otp",
|
||
"vendor": "Erlang",
|
||
"versions": [
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "9.3.2.7",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "9.6.2.3",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "9.7.2",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "*",
|
||
"status": "affected",
|
||
"version": "7.1.2",
|
||
"versionType": "otp"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"collectionURL": "https://github.com",
|
||
"cpes": [
|
||
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
|
||
],
|
||
"defaultStatus": "unaffected",
|
||
"packageName": "erlang/otp",
|
||
"packageURL": "pkg:github/erlang/otp",
|
||
"product": "OTP",
|
||
"repo": "https://github.com/erlang/otp",
|
||
"vendor": "Erlang",
|
||
"versions": [
|
||
{
|
||
"changes": [
|
||
{
|
||
"at": "60add5a19e2154560fdff3fe92dba14a68bbd683",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "6cd995e34d3bb3d36dd278dded2d62c25e71820c",
|
||
"status": "unaffected"
|
||
},
|
||
{
|
||
"at": "c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f",
|
||
"status": "unaffected"
|
||
}
|
||
],
|
||
"lessThan": "*",
|
||
"status": "affected",
|
||
"version": "c06db0bedf49a9b40725745e73fa82e562612815",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "27.3.4.17",
|
||
"versionStartIncluding": "22.2",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "28.5.0.6",
|
||
"versionStartIncluding": "28.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "29.0.6",
|
||
"versionStartIncluding": "29.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
}
|
||
],
|
||
"operator": "AND"
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "remediation developer",
|
||
"value": "Konrad Pietrzak / Ericsson"
|
||
},
|
||
{
|
||
"lang": "en",
|
||
"type": "reporter",
|
||
"value": "Lukas Backström / Erlang Solutions"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<p>Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.</p>\n<p>This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6.2.3, and 9.7.2.</p>"
|
||
},
|
||
{
|
||
"base64": false,
|
||
"type": "text/markdown",
|
||
"value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6.2.3, and 9.7.2."
|
||
}
|
||
],
|
||
"value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP 22.2 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, 9.6.2.3, and 9.7.2."
|
||
}
|
||
],
|
||
"impacts": [
|
||
{
|
||
"capecId": "CAPEC-33",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "CAPEC-33 HTTP Request Smuggling"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV4_0": {
|
||
"Automatable": "NOT_DEFINED",
|
||
"Recovery": "NOT_DEFINED",
|
||
"Safety": "NOT_DEFINED",
|
||
"attackComplexity": "LOW",
|
||
"attackRequirements": "PRESENT",
|
||
"attackVector": "NETWORK",
|
||
"baseScore": 8.3,
|
||
"baseSeverity": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"providerUrgency": "NOT_DEFINED",
|
||
"subAvailabilityImpact": "NONE",
|
||
"subConfidentialityImpact": "NONE",
|
||
"subIntegrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"valueDensity": "NOT_DEFINED",
|
||
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
|
||
"version": "4.0",
|
||
"vulnAvailabilityImpact": "NONE",
|
||
"vulnConfidentialityImpact": "LOW",
|
||
"vulnIntegrityImpact": "HIGH",
|
||
"vulnerabilityResponseEffort": "NOT_DEFINED"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-444",
|
||
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
|
||
"shortName": "EEF",
|
||
"dateUpdated": "2026-11-11T13:44:01.526Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p"
|
||
},
|
||
{
|
||
"name": "EEF CNA record for CVE-2026-73276",
|
||
"tags": [
|
||
"related"
|
||
],
|
||
"url": "https://cna.erlef.org/cves/CVE-2026-73276.html"
|
||
},
|
||
{
|
||
"name": "OSV record EEF-CVE-2026-73276",
|
||
"tags": [
|
||
"related"
|
||
],
|
||
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-73276"
|
||
},
|
||
{
|
||
"name": "Erlang/OTP version ordering",
|
||
"tags": [
|
||
"x_version-scheme"
|
||
],
|
||
"url": "https://www.erlang.org/doc/system/versions.html#order-of-versions"
|
||
},
|
||
{
|
||
"name": "Introducing commit c06db0b in erlang/otp",
|
||
"tags": [
|
||
"related"
|
||
],
|
||
"url": "https://github.com/erlang/otp/commit/c06db0bedf49a9b40725745e73fa82e562612815"
|
||
},
|
||
{
|
||
"name": "Fix commit 60add5a in erlang/otp",
|
||
"tags": [
|
||
"patch"
|
||
],
|
||
"url": "https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683"
|
||
},
|
||
{
|
||
"name": "Fix commit 6cd995e in erlang/otp",
|
||
"tags": [
|
||
"patch"
|
||
],
|
||
"url": "https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c"
|
||
},
|
||
{
|
||
"name": "Fix commit c285240 in erlang/otp",
|
||
"tags": [
|
||
"patch"
|
||
],
|
||
"url": "https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "UNKNOWN"
|
||
},
|
||
"title": "inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i"
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-09-01T15:55:23.919951Z",
|
||
"id": "CVE-2026-73276",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-09-01T15:55:30.190Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |