CVE-2026-48856: erlang/inets from 5.10 (inclusive), before 9.3.2.6 (exclusive), from 9.6 (inclusive), before 9.6.2.2 (exclusive), from…

Affected technology

erlang/inets · from 5.10 (inclusive), before 9.3.2.6 (exclusive)
erlang

erlang/inets · from 9.6 (inclusive), before 9.6.2.2 (exclusive)
erlang

erlang/inets · from 9.7 (inclusive), before 9.7.1 (exclusive)
erlang

erlang/otp · from 17.0 (inclusive), before 27.3.4.13 (exclusive)
erlang

erlang/otp · from 28.0 (inclusive), before 28.5.0.2 (exclusive)
erlang

erlang/otp · from 29.0 (inclusive), before 29.0.2 (exclusive)
erlang

OTP · 17.0 to before *; status changes: 27.3.4.19 — unaffected, 28.5.0.8 — unaffected, 29.1.2 — unaffected
Erlang

OTP · 5.10 to before *; status changes: 9.3.2.8 — unaffected, 9.6.2.4 — unaffected, 9.8.1 — unaffected
Erlang

OTP · 84adefa331c4159d432d22840663c38f155cd4c1 to before f78fae9294886f95545a2212671282eda230def1
Erlang

Component: httpc_response
Function: httpc_response:redirect/2
File: lib/inets/src/http_client/httpc_response.erl, src/http_client/httpc_response.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.