CVE-2026-73276
NoneCVSS
—
EPSS
0.6%
Published
Sep 1, 2026
CISA due date
—
The record
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-112212 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before… CWE-444
- CVE-2026-111750 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-444
- CVE-2026-88829 A flaw was found in BusyBox httpd's reverse proxy feature. CWE-444
- CVE-2026-94439 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns… CWE-444
- CVE-2026-78660 Historically, we have been rather lax about malformed framing-related headers in our… CWE-444
- CVE-2026-56866 When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it… CWE-444
- CVE-2026-85078 Sanic is an opensource python web server/framework. CWE-444
- CVE-2026-81356 Inconsistent interpretation of http requests ('http request/response smuggling') in… CWE-444