Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-48856: Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sen

29
Routine
MEDIUM 6.5UPGRADEUPGRADE

CVE-2026-48856 is a medium-severity flaw (CVSS 6.5) affecting erlang\/inets, erlang\/otp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score6.5 (Medium)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededLow
User interactionNone
EPSS exploit chance0.3% (top 73%)
CISA exploited listNo
WeaknessCWE-601
Published2026-06-10
Last modified2026-10-26
Publisher (CNA): EEF · Vendor: erlang

Share: LinkedIn · X · Reddit

Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

erlang erlang\/inets UPGRADE
Affected: >= 5.10 and < 9.3.2.6 · >= 9.6 and < 9.6.2.2 · >= 9.7 and < 9.7.1
Fixed in: 9.3.2.6, 9.6.2.2, 9.7.1
Safe to downgrade to: a release before 5.10
1. Check installed version
apt-cache policy erlanginets || rpm -q erlanginets || erlanginets --version
2. UPGRADE to 9.3.2.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade erlanginets
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade erlanginets
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 5.10 (Debian / Ubuntu)
apt-cache madison erlanginets sudo apt install erlanginets=<VERSION_BEFORE_5.10> sudo apt-mark hold erlanginets
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list erlanginets sudo dnf downgrade erlanginets-<VERSION_BEFORE_5.10> sudo dnf versionlock add erlanginets
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
erlang erlang\/otp UPGRADE
Affected: >= 17.0 and < 27.3.4.13 · >= 28.0 and < 28.5.0.2 · >= 29.0 and < 29.0.2
Fixed in: 27.3.4.13, 28.5.0.2, 29.0.2
Safe to downgrade to: a release before 17.0
1. Check installed version
apt-cache policy erlangotp || rpm -q erlangotp || erlangotp --version
2. UPGRADE to 27.3.4.13 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade erlangotp
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade erlangotp
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 17.0 (Debian / Ubuntu)
apt-cache madison erlangotp sudo apt install erlangotp=<VERSION_BEFORE_17.0> sudo apt-mark hold erlangotp
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list erlangotp sudo dnf downgrade erlangotp-<VERSION_BEFORE_17.0> sudo dnf versionlock add erlangotp
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-48856?

erlang\/inets: upgrade to 9.3.2.6, 9.6.2.2, 9.7.1; erlang\/otp: upgrade to 27.3.4.13, 28.5.0.2, 29.0.2. Exact commands for each OS are on this page.

Is CVE-2026-48856 being exploited?

CVE-2026-48856 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-48856 affect?

CVE-2026-48856 affects erlang\/inets, erlang\/otp. Severity is medium (CVSS 6.5). Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without chec

How urgent is CVE-2026-48856?

Priority 29/100. No elevated risk signals yet.

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.