CVE-2026-71380

CVE-2026-71380 is a missing release of resource after effective lifetime (CWE-772) in the httpd HTTP server of Erlang/OTP's inets application: once the request headers parse successfully, the handler cancels the request timeout, and while waiting for the announced body it re-arms the socket with no replacement timer, so the worker waits indefinitely. An unauthenticated remote attacker triggers this by sending a well-formed request with a large Content-Length and then stalling before the body is complete; because the byte-rate reaper is only armed when minimum_bytes_per_second is configured (not the default), each stalled connection permanently occupies a worker. By repeating this across connections, the attacker ties up every worker permitted by max_clients and denies service to legitimate clients at negligible bandwidth cost. Any deployment running the affected inets httpd versions is affected, particularly where httpd is reachable from untrusted networks. No public proof-of-concept or in-the-wild exploitation is known; EPSS assigns a 0.4% probability of exploitation within 30 days and the issue is not in CISA KEV.

What to do: Upgrade to OTP 27.3.4.17 (inets 9.3.2.7), OTP 28.5.0.6 (inets 9.6.2.3), or OTP 29.0.6 (inets 9.7.2), or later. As an interim mitigation, configure minimum_bytes_per_second so the periodic byte-rate check reclaims stalled workers, and consider capping max_clients and shielding httpd behind a proxy or load balancer with idle timeouts. Audit your estate to determine whether any service exposes the inets httpd server to untrusted networks.