Description
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.
Published: 2026-09-01
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Workaround
AI Analysis

Impact

A malformed HTTP chunk-size line that is not a hexadecimal number causes the Erlang/OTP inets httpd worker to be parked indefinitely. The chunk-size line must arrive in a separate write from the headers; when it does, httpd_request_handler misinterprets the exception thrown by the chunk decoder, turning it into an error tuple that is treated as a decoder continuation. The socket is re‑armed and the worker waits for data that never arrives, while the request timeout has already been cancelled. Because no timeout or byte‑rate check is enabled by default, the stuck worker is never reclaimed. Repeating such requests on multiple connections consumes every available worker, thereby denying service to legitimate clients. No authentication is required. The core flaw is an improper release of resources after a fault, which matches CWE‑772.

Affected Systems

This issue affects Erlang:OTP versions 18.1.4 up to but not including 27.3.4.17, 28.5.0.6, and 29.0.6; the matching inets releases are 6.0.3 up to but not including 9.3.2.7, 9.6.2.3, and 9.7.2, all under the default httpd configuration.

Risk and Exploitability

The vulnerability scores a CVSS of 8.7 and is not listed in the CISA KEV catalog. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation. The simplicity of the attack – an unauthenticated HTTP client sending a body with a non‑hex chunk‑size line after the headers – means the vulnerability can be triggered easily over the network. The likely attack vector is a remote, unauthenticated HTTP client that sends a malformed request, causing one httpd worker to park and ultimately exhaust all workers.

Generated by OpenCVE AI on September 22, 2026 at 11:24 UTC.

Remediation

Vendor Workaround

* Set minimum_bytes_per_second in the httpd configuration, for example {minimum_bytes_per_second, 200}. This arms a periodic byte-rate check that terminates a connection which has stopped delivering data, reclaiming the parked worker within a few seconds. The check is disabled by default, and any positive value suffices because an affected connection delivers no further data at all. * Place a reverse proxy in front of httpd that validates chunked transfer encoding and rejects malformed chunk framing before it reaches httpd. * Restrict access to the server to trusted clients where the deployment allows it.

OpenCVE Recommended Actions

  • Set the minimum_bytes_per_second configuration option in httpd, for example {minimum_bytes_per_second, 200}, to enable a periodic check that terminates stalled connections and frees parked workers.
  • Deploy a reverse proxy that validates chunked transfer encoding and rejects malformed chunk framing before forwarding requests to httpd.
  • Restrict direct access to the Erlang httpd service to trusted clients if the deployment allows it.

Generated by OpenCVE AI on September 22, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8827-1 Erlang vulnerabilities
History

Tue, 22 Sep 2026 09:30:00 +0000

Type Values Removed Values Added
Description Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.
References

Thu, 03 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Title httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-772
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-22T09:10:07.550Z

Reserved: 2026-08-17T10:45:02.808Z

Link: CVE-2026-69664

cve-icon Vulnrichment

Updated: 2026-09-01T17:45:02.772Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T15:17:23.677

Modified: 2026-09-22T10:17:09.610

Link: CVE-2026-69664

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-01T14:59:03Z

Links: CVE-2026-69664 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T11:30:09Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime