The vulnerability arises from Erlang/OTP’s inets httpd component failing to enforce its documented default maximum client limit of 150. When this option is not explicitly set, the accept gate interprets the missing value as undefined rather than the default, allowing an attacker to open an unrestricted number of simultaneous connections without authentication or a valid request. Each connection consumes a worker process and a socket, rapidly exhausting system resources such as memory, file descriptors, and process slots, which can bring the node or entire host down.

The issue affects Erlang/OTP deployments that use the inets httpd module. Specifically, any OTP release prior to OTP 27.3.4.17, OTP 28.5.0.6, or OTP 29.0.6 is vulnerable. This includes inets releases 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, and 9.7 before 9.7.2. Systems running these versions without an explicitly configured max_clients value are impacted.

The CVSS score of 8.7 signals a high severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the exploitation probability cannot be quantified but the lack of authentication and the ability to saturate resources makes successful attacks likely in a practical setting. The attack vector is inferred to be remote, via any network interface that can connect to the httpd service, as no credentials are required and the attacker only needs the ability to open TCP connections.