CVE-2026-66357

Executive Summary

CVE-2026-66357 is a vulnerability in the Erlang OTP httpd component (inets) caused by the implementation never supporting obsolete line folding (obs-fold) as defined in RFC 2616 §2.2 and RFC 7230 §3.2.4. Because the server unconditionally treats every CRLF followed by a non-CRLF octet as the start of a new header, this behavior can be abused in HTTP request smuggling attacks when combined with intermediaries (proxies, CDNs, load balancers) that do implement obs-fold. The issue affects OTP versions from 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, and 29.0 before 29.0.6 — corresponding to inets versions 5.10 through 9.7.2. As of this report, no CVSS score has been assigned, no public exploit code exists, and no patch has been confirmed by tracked sources.

Technical Analysis

The vulnerability stems from a fundamental protocol parsing discrepancy. HTTP/1.1 defines header continuation lines — a mechanism that allows a header to continue on subsequent lines when those lines begin with a space or tab. This mechanism, known as "obs-fold" (obsolete line folding), was deprecated in RFC 7230 but remains implemented in many HTTP stacks for interoperability reasons.

The Erlang httpd server never implemented obs-fold. Instead, its parser treats any CRLF followed by a non-CRLF octet as the unambiguous beginning of a new header field. This means a request such as:

X-First: value\r\n continued-value\r\nX-Second: data

...is interpreted by httpd as two separate headers (X-First: value and continued-value — which would be a header with an empty field name or rejected), whereas a front-end proxy that supports obs-fold would interpret the same request as a single header (X-First: value continued-value).

This parser desynchronization is the root cause of HTTP request smuggling. When requests pass through multiple systems (e.g., a CDN or reverse proxy in front of httpd), the systems disagree on where one request ends and the next begins, on how many headers exist, and on which header values apply to what. An attacker can craft payloads that are interpreted as a single request by the front-end but as multiple headers or malformed requests by httpd, leading to request smuggling, cache poisoning, or request queue poisoning.

The affected component is httpd within the inets application of OTP. The advisory groups affected versions as follows: OTP 17.0 through 27.3.4.17 (inets 5.10 through 9.3.2.7), OTP 28.0 through 28.5.0.6 (inets 9.4 through 9.6.2.3), and OTP 29.0 through 29.0.6 (inets 9.7 through 9.7.2). No evidence indicates that OTP versions before 17.0 (inets before 5.10) are affected, but this is stated as unknown rather than confirmed safe.

The vulnerability class is CWE-444 "Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')". The attack surface is any deployment where an Erlang httpd server sits behind an HTTP intermediary that supports obs-fold. This includes typical web application architectures with CDNs, load balancers, or reverse proxies.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-66357. The attack chain below is inferred from the vulnerability class (HTTP request smuggling via obs-fold parsing desynchronization) and the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker identifies a target that exposes an Erlang OTP httpd endpoint, typically behind a CDN, reverse proxy, or load balancer. Shodan queries such as "erlang httpd" or fingerprinting of the Server header — which commonly reveals inets or httpd — are used to locate candidates. The attacker must also confirm that the front-end intermediary supports obs-fold; this can be probed by sending a header with a continuation line and observing whether the front-end passes it through unmodified.

Step 2 — Triggering the Flaw: The attacker sends an HTTP/1.1 request containing a header with a CRLF continuation line that the front-end treats as folded (i.e., part of the previous header) but that httpd treats as a new header. The exact delimiter sequence (CRLF followed by a non-CRLF octet such as a space or tab) is the core trigger — the front-end consumes it as part of the existing header, while httpd terminates the header at the CRLF.

Step 3 — Payload Execution at the Class Level: At the vulnerability-class level, the attacker constructs a request that is parsed differently by the two systems. A classic pattern involves embedding a second request (or portions of one) inside a folded header continuation. For example:

POST / HTTP/1.1
Host: victim
X-Forwarded: value\r\n
 GET /admin HTTP/1.1\r\n
Host: internal\r\n

The front-end (obs-fold aware) treats GET /admin... as a continuation of the X-Forwarded header. httpd, which does not support obs-fold, sees GET /admin as the start of a new header — and depending on how it handles the malformed shape, the request boundary is shifted. In a smuggling scenario, the front-end may believe the connection's next request begins at a different byte offset than httpd does, allowing the attacker to inject a request that is only seen by the backend.

Step 4 — Post-Exploitation Impact: Depending on the deployment, successful request smuggling can result in any of the following: request queue poisoning (the attacker's request contaminates the next legitimate user's request), cache poisoning (if a cache exists between the attacker and httpd), authentication bypass (by smuggling requests into internal-only endpoints that bypass front-end access controls), session hijacking, or data exfiltration. The severity depends on what is reachable behind the front-end and whether httpd exposes any administrative or internal functions.

It is acceptable to note: no public PoC exists; the attack chain is derived entirely from the vulnerability class and the NVD description.

Impact Assessment

The business impact of CVE-2026-66357 is significant for organizations running Erlang OTP httpd in production behind HTTP intermediaries. The vulnerability enables request smuggling, which can lead to:

• Request Queue Poisoning: An attacker can contaminate the persistent connection such that the next legitimate user's request is processed with attacker-influenced headers or body content, potentially exposing session tokens or enabling account takeover.
• Cache Poisoning: If a cache sits in front of httpd, content can be cached for the wrong URL, serving malicious content to all subsequent visitors.
• Security Control Bypass: Front-end WAFs, authentication proxies, and rate limiters can be bypassed because the smuggled request is invisible to them.
• Data Exposure: Requests containing sensitive data may be misrouted, and internal endpoints that were meant to be protected by the front-end become directly reachable.

The affected systems span OTP versions 17.0 through 29.0.6 — a wide window. The fact that the vendor explicitly notes it is unknown whether OTP pre-17.0 is affected further widens the potential exposure. Any Erlang-based web server deployment using httpd is affected if fronted by a proxy that implements obs-fold, which includes many popular CDNs, Nginx, HAProxy, and cloud load balancers.

No CVSS vector or score is assigned, and no EPSS value is available. The absence of a CISA KEV listing indicates there is no evidence of active exploitation in the wild at the time of publication. The patch confidence is 0/4, meaning no official patch has been confirmed — this raises the urgency of exposure assessment and mitigation planning.

Detection Guidance

The following detection guidance is generated from the vulnerability class (HTTP request smuggling via obs-fold) since no public exploit signatures exist.

Sigma Rule

title: HTTP Request Smuggling via Obs-Fold Header Continuation
id: 4f6a2c9e-1b3d-4a5e-8f2c-9b1a3d4e5f6a
status: experimental
description: Detects HTTP requests containing header continuation lines (CRLF followed by space/tab or non-CRLF octet) that may indicate obs-fold smuggling attempts against Erlang httpd.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-66357
author: Valtersit Threat Intelligence
date: 2026/06/01
logsource:
    category: webserver
    product: httpd
    service: access
detection:
    selection:
        cs-method: "POST"
        cs-uri-query|contains: "\r\n "
    condition: selection
falsepositives:
    - Legitimate clients sending obs-fold headers (rare in modern clients)
    - Proxies that forward unmodified request lines
level: high

YARA Rule

rule HTTP_Request_Smuggling_ObsFold_HeaderContinuation
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP requests with CRLF followed by space/tab (obs-fold continuation lines) indicative of request smuggling attempts against Erlang httpd"
        cve = "CVE-2026-66357"
        date = "2026-06-01"
    strings:
        $fold_space = { 0D 0A 20 }
        $fold_tab = { 0D 0A 09 }
        $http_header_marker = "HTTP/"
        $header_sep = ": "
    condition:
        $http_header_marker and (#fold_space > 0 or #fold_tab > 0) and ($header_sep)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS Possible Erlang httpd Obs-Fold Request Smuggling (CVE-2026-66357)"; flow:established,to_server; http.request_line; content:"POST"; http.header_names; pcre:/^(?:[^\r\n]*\r\n){0,10}[^\r\n]*\r\n[ \t]/; classtype:web-application-attack; sid:66266357; rev:1; metadata:created_at 2026_06_01, updated_at 2026_06_01, cve CVE-2026-66357;)

Elastic Detection

any where process.name == "httpd" and network.protocol == "http" and event.dataset == "httpd.access" and http.request.method == "POST" and url.path : "*" and http.request.headers : "*\r\n *" and http.request.headers : "*\r\n\t*"

Splunk SPL Query

index=web sourcetype=access_combined_w3c
| where like(_raw, "%\r\n %") OR like(_raw, "%\r\n\t%")
| stats count by src_ip, uri, status
| where count > 1
| rename count as "ObsFold Request Count"
| sort - "ObsFold Request Count"

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="910460" level="10">
    <decoded_as>http</decoded_as>
    <match>POST</match>
    <regex>%0d%0a[ \t]|\r\n[ \t]</regex>
    <description>Possible Erlang httpd Obs-Fold Request Smuggling attempt (CVE-2026-66357)</description>
    <group>web_application,request_smuggling,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence exists from any tracked source at the time of this report. The vendor has documented affected versions but no confirmed fix has been published to the tracked patch sources.

1) Immediate Mitigations:

• Place Erlang httpd behind a front-end proxy that normalizes obs-fold headers — i.e., a proxy that either strips continuation lines or rejects requests containing them. This reconciles parser behavior and removes the desynchronization.
• Configure the front-end proxy to reject any HTTP request whose header section contains CRLF followed by SP/HTAB (i.e., deny obs-fold outright). This is supported by many reverse proxies (e.g., Nginx ignore_invalid_headers on, HAProxy option reject-request with appropriate ACLs).
• If immediate proxy hardening is not possible, restrict access to the httpd endpoint to trusted networks only, limiting who can reach the vulnerable server directly.
• Monitor access logs for requests containing literal \r\n or \r\n\t patterns in headers (as per the detection rules above) and alert on anomalies.

2) Patch/Upgrade Steps:

• Upgrade Erlang/OTP to a version newer than the affected ranges: OTP 27.3.4.17+, OTP 28.5.0.6+, or OTP 29.0.6+. Verify that the corresponding inets version (9.3.2.7+, 9.6.2.3+, or 9.7.2+ respectively) is installed.
• Check the official Erlang OTP security advisory page for the definitive patched version lists — the maintainers may publish fixes after this report is generated.
• Rebuild and redeploy any container images, VMs, or releases using the updated OTP version.
• Validate behavior with a regression test that sends a request containing a obs-fold continuation line and confirms the server rejects or correctly parses it.

3) Long-Term Hardening:

• Eliminate the use of httpd in favor of more actively maintained HTTP servers for Erlang deployments, or harden it thoroughly.
• Implement strict HTTP protocol validation at the network edge: reject requests that do not conform to RFC 7230 header rules (no obs-fold, proper CRLF handling, no whitespace in methods or targets).
• Adopt HTTP/2 or HTTP/3 at the front-end where possible — these versions do not support obs-fold at all, and the differing parsing semantics are eliminated.
• Ensure all HTTP stacks in the path (CDN, WAF, reverse proxy, backend) are kept current with their respective security patches.
• Perform periodic red-team testing of request smuggling classes against all HTTP entry points, using tools such as smuggler or manual testing.

References

1. NVD Entry for CVE-2026-66357: https://nvd.nist.gov/vuln/detail/CVE-2026-66357
2. Erlang OTP Security Advisories (official): https://www.erlang.org/security-advisories (verify for CVE-2026-66357)
3. RFC 7230 Section 3.2.4 — Header Field Parsing and obs-fold: https://datatracker.ietf.org/doc/html/rfc7230#section-3.2.4
4. CWE-444 — Inconsistent Interpretation of HTTP Requests: https://cwe.mitre.org/data/definitions/444.html
5. PortSwigger Research — HTTP Request Smuggling (background on the attack class): https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

No evidence of known threat actor campaigns or exploitation in the wild has been identified for CVE-2026-66357 at the time of this report. CISA KEV status: NO.