SEPTEMBER 18, 2026
Live Feed
Back to database
Case File

CVE-2026-73276

HIGH · CVSS 8.3 EPSS 0.33% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-01 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The vulnerability arises from the Gracefulness code in OTP, which fails to properly reject certain cases, potentially allowing for HTTP Request Smuggling attacks. This could lead to unauthorized access or manipulation of web traffic, posing a significant risk to applications relying on affected OTP versions. Organizations using these versions should prioritize patching to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-73276
Severity
HIGH
CVSS
8.3
EPSS
0.33%

Original NVD Description

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.