CVE-2026-55951 - Vulnerability Details

- httpc memory exhaustion via unbounded response header accumulation

Description

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received).

A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds.

Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Published: 2026-09-01

Score: 8.2 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Erlang/OTP httpc HTTP client fails to enforce a limit on the total size of response headers received from a server. The default nolimit setting causes the header parser to accumulate all headers into memory before performing a length check, allowing an attacker to allocate unbounded memory and crash the BEAM VM or exhaust system resources. This flaw results in a denial‑of‑service condition and is classified under CWE‑770.

Affected Systems

The vulnerability affects the Erlang/OTP system, specifically the httpc HTTP client and the inets library. Affected releases include OTP 17.0 through OTP 27.3.4.17, OTP 28.0 through OTP 28.5.0.6, and OTP 29.0 through OTP 29.0.6; the corresponding inets versions are 5.10 through 9.3.2.7, 9.4 through 9.6.2.3, and 9.7 through 9.7.2. Whether OTP prior to 17.0 (inets prior to 5.10) is affected remains unknown.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.2, indicating high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. An attacker can trigger the exhaustion by acting as an HTTP server and sending a large number of headers or very large header values; authentication is not required. Proof‑of‑concept demonstrations have shown 100,000 headers of roughly 4,000 bytes each forcing the client VM to allocate over 13 GB of memory in under 30 seconds, underscoring the practical risk of exploitation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unaffected

Version	Status	Constraints
`0`	unknown	< 17.0
`17.0`	affected	< 27.3.4.17
`28.0`	affected	< 28.5.0.6
`29.0`	affected	< 29.0.6

Erlang

OTP

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10
`5.10`	affected	< 9.3.2.7
`9.4`	affected	< 9.6.2.3
`9.7`	affected	< 9.7.2

Erlang

OTP

unaffected

Version	Status	Constraints
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	< *

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

95%

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[0,17.0)`	unknown	generic	—
`[17.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	semver	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[0,5.10)`	unknown	generic	—
`[5.10,9.3.2.7)`	affected	generic	—
`[9.4,9.6.2.3)`	affected	generic	—
`[9.7,9.7.2)`	affected	semver	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[84adefa331c4159d432d22840663c38f155cd4c1,*]`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

Vendor Workaround

* Restrict httpc to trusted servers only, and avoid using it to fetch resources from arbitrary or user-supplied URLs. * Apply operating-system memory limits (cgroups,ulimit) to contain the blast radius of a runaway client process. * Use an alternative HTTP client library that enforces a response header size limit.

OpenCVE Recommended Actions

Upgrade to a patched OTP release – OTP 27.3.4.17 or later, OTP 28.5.0.6 or later, or OTP 29.0.6 or later, which contain the proper header size limit enforcement.
Restrict httpc usage to trusted servers only and avoid fetching resources from arbitrary or user‑supplied URLs.
Apply operating‑system memory limits (cgroups, ulimit) to contain the blast radius of a runaway Erlang process.
Switch to an alternative HTTP client library that enforces a response header size limit, or configure httpc’s max_header_size parameter to a reasonable bound if supported.

Generated by OpenCVE AI on September 1, 2026 at 15:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00382.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-55951.html
https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d
https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa
https://github.com/erlang/otp/security/advisories/GHSA-f9fw-mg7q-4g3x
https://osv.dev/vulnerability/EEF-CVE-2026-55951
https://www.erlang.org/doc/system/versions.html#order-of-versions

History

Tue, 01 Sep 2026 22:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 01 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates every header into a list before the length check runs (which only fires after the terminating CRLF CRLF is received). A malicious or compromised HTTP server can send an arbitrarily large number of headers, or headers with very large values, causing the client process to allocate unbounded memory until the system runs out of memory or the BEAM VM crashes. A proof-of-concept server sending 100,000 headers of roughly 4000 bytes each caused the client VM to allocate over 13 GB of memory in under 30 seconds. Any application using httpc:request/4,5 to connect to untrusted servers is affected. No authentication is required: any server the client connects to (including via a redirect or man-in-the-middle) can trigger the exhaustion. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Title		httpc memory exhaustion via unbounded response header accumulation
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-770
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-55951.html https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa https://github.com/erlang/otp/security/advisories/GHSA-f9fw-mg7q-4g3x https://osv.dev/vulnerability/EEF-CVE-2026-55951 https://www.erlang.org/doc/system/versions.html#order-of-versions
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-09-01T14:37:02.650Z

Updated: 2026-09-08T01:06:43.872Z

Reserved: 2026-06-17T17:55:15.685Z

Link: CVE-2026-55951

Vulnrichment

Updated: 2026-09-01T15:54:11.168Z

NVD

Status : Deferred

Published: 2026-09-01T15:17:20.780

Modified: 2026-09-08T01:17:50.477

Link: CVE-2026-55951

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-01T16:00:13Z

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object