UpHeron
All vulnerabilities

Servers and applications

CVE-2026-48856

Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header…

Severity
High 7.1
Published
10 Jun 2026
Last changed
15 Oct 2026
Added to UpHeron
16 Oct 2026
Fixed in
27.3.4.13, 28.5.0.2, 29.0.2
Sources
NVD

Affected software

SoftwareAffected versions
Erlang/OTPServers and applications · cpe:a:erlang:erlang\/otp
  • From 17.0 before 27.3.4.13
  • From 28.0 before 28.5.0.2
  • From 29.0 before 29.0.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-48856
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-48856