CVE-2026-23941

Erlang OTP (inets httpd moduli) da HTTP so'rovlarining nomuvofiq talqini ('HTTP so'rovi kontrabandasi') zaifligi HTTP so'rovi kontrabandasiga imkon beradi.

 Ushbu zaiflik lib/inets/src/http_server/httpd_request.erl dastur fayllari va httpd_request:parse_headers/7 dastur rutinlari bilan bog'liq.

 Server takroriy Content-Length sarlavhalarini rad etmaydi yoki normallashtirmaydi. So'rovdagi eng qadimgi Content-Length asosiy tahlil uchun ishlatiladi, umumiy teskari proksi-serverlar esa (nginx, Apache httpd, Envoy)

Manbalar

• https://github.com/erlang/otp/commit/a4b46336fd25aa100ac602eb9a627aaead7eda18
• https://github.com/erlang/otp/commit/a761d391d8d08316cbd7d4a86733ba932b73c45b
• https://github.com/erlang/otp/commit/e775a332f623851385ab6ddb866d9b150612ddf6
• https://github.com/erlang/otp/security/advisories/GHSA-w4jc-9wpv-pqh7
• https://www.erlang.org/doc/system/versions.html#order-of-versions