CVE-2026-69664
Unauthenticated worker-leak DoS in Erlang/OTP inets httpd via malformed chunked request
Erlang/OTP's inets HTTP server (httpd) contains a missing-resource-release flaw (CWE-772) that lets an unauthenticated remote attacker exhaust its worker processes and cause a denial of service. The attack is an HTTP request with a chunked body whose chunk-size line is not a hexadecimal number and arrives in a write separate from the headers: the error thrown by the chunk decoder is converted into an error tuple that is treated as the next decoder continuation, so the worker re-arms the socket and waits forever for data that never arrives, with the request timeout already cancelled and no byte-rate check armed in the default configuration. Repeating the request across new connections occupies every available worker until legitimate clients can no longer be served. Any deployment running an affected Erlang/OTP (from 18.1.4 before 27.3.4.17, from 28.0 before 28.5.0.6, or from 29.0 before 29.0.6, corresponding to inets 6.0.3 before 9.3.2.7, 9.4 before 9.6.2.3, or 9.7 before 9.7.2) with the default configuration is affected. No public proof-of-concept or in-the-wild exploitation is known; EPSS puts the 30-day exploitation probability at 0.7%.
What to do: Upgrade Erlang/OTP to 27.3.4.17, 28.5.0.6, or 29.0.6 depending on your branch (or to the corresponding fixed inets releases 9.3.2.7, 9.6.2.3, or 9.7.2). As an interim mitigation, configure minimum_bytes_per_second so httpd's periodic byte-rate check is armed and can reclaim stuck workers, and place httpd behind a reverse proxy with per-IP connection limits and rate limiting. First confirm which of your Erlang/OTP deployments actually run the inets httpd server, since OTP installations not serving HTTP via inets are not affected.
| Erlang/OTP (inets httpd) | >= 18.1.4, < 27.3.4.17; >= 28.0, < 28.5.0.6; >= 29.0, < 29.0.6 |
| Erlang/OTP inets | >= 6.0.3, < 9.3.2.7; >= 9.4, < 9.6.2.3; >= 9.7, < 9.7.2 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
- Weakness
- CWE-772
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news0 stories
No ingested article mentions this CVE yet.