Description
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.

The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.

This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Published: 2026-09-01
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Workaround
AI Analysis

Impact

A malformed HTTP chunk-size line that is not a hexadecimal number causes the Erlang/OTP inets httpd worker to be parked indefinitely. The worker never releases, and the request timeout is already cancelled, allowing an attacker to deplete all available workers by repeatedly sending such requests. This results in denial of service against legitimate clients, with no authentication required. The weakness involves improper release of resources after a fault has occurred.

Affected Systems

This issue affects Erlang:OTP, specifically versions from OTP 18.1.4 up to but not including 27.3.4.17, from OTP 28.0 up to but not including 28.5.0.6, and from OTP 29.0 up to but not including 29.0.6. The corresponding inets releases are 6.0.3 through 9.3.2.7, 9.4 through 9.6.2.3, and 9.7 through 9.7.2, all under the default httpd configuration.

Risk and Exploitability

The vulnerability scores a CVSS of 8.7 and is not listed in the CISA KEV catalog. Although EPSS data is not available, the impact is high due to the simple attack that requires only a malformed request sent over the network. The likely attack vector is a remote, unauthenticated HTTP client that sends a body with a non-hex chunk-size line after the headers, causing one httpd worker to park and ultimately exhaust all workers.

Generated by OpenCVE AI on September 1, 2026 at 16:17 UTC.

Remediation

Vendor Workaround

* Set minimum_bytes_per_second in the httpd configuration, for example {minimum_bytes_per_second, 200}. This arms a periodic byte-rate check that terminates a connection which has stopped delivering data, reclaiming the parked worker within a few seconds. The check is disabled by default, and any positive value suffices because an affected connection delivers no further data at all. * Place a reverse proxy in front of httpd that validates chunked transfer encoding and rejects malformed chunk framing before it reaches httpd. * Restrict access to the server to trusted clients where the deployment allows it.

OpenCVE Recommended Actions

  • Set the minimum_bytes_per_second configuration option in httpd, for example {minimum_bytes_per_second, 200}, to enable a periodic check that terminates stalled connections and frees parked workers.
  • Deploy a reverse proxy that validates chunked transfer encoding and rejects malformed chunk framing before forwarding requests to httpd.
  • Restrict direct access to the Erlang httpd service to trusted clients if the deployment allows it.

Generated by OpenCVE AI on September 1, 2026 at 16:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 03 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 15:15:00 +0000

Type Values Removed Values Added
Description Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Title httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-772
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-08T01:08:30.885Z

Reserved: 2026-08-17T10:45:02.808Z

Link: CVE-2026-69664

cve-icon Vulnrichment

Updated: 2026-09-01T17:45:02.772Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T15:17:23.677

Modified: 2026-09-08T01:17:52.473

Link: CVE-2026-69664

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-01T14:59:03Z

Links: CVE-2026-69664 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T18:00:18Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime