Description
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete.

httpd_request_handler:handle_info/2 cancels the request timeout as soon as a parse step succeeds, which includes the headers, and the clause that handles a decoder asking for more data re-arms the socket with {active, once} without setting any further timer. httpd_request:whole_body/2 returns such a continuation whenever the bytes received are fewer than the announced Content-Length, so a well-formed request that stops mid-body leaves the worker waiting indefinitely. The periodic byte-rate check that would reclaim it is armed only when minimum_bytes_per_second is configured, which it is not by default. Repeating this across connections occupies every worker permitted by max_clients and denies service to legitimate clients at negligible bandwidth cost.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Published: 2026-09-01
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

Erlang/OTP’s inets httpd module does not enforce a timeout while receiving a request body. The handler cancels the request timeout as soon as the headers are parsed and does not establish a new timer when more data is requested. If an attacker sends a valid request with a large Content-Length and stalls before sending the body, the worker thread remains parked indefinitely and idle. This releases no system resources after the effective lifetime, causing a denial of service for all subsequent requests.

Affected Systems

The vulnerability is present in Erlang/OTP releases starting with OTP 17.0 up to OTP 27.3.4.17, OTP 28.0 up to OTP 28.5.0.6, and OTP 29.0 up to OTP 29.0.6. Corresponding inets library versions 5.10 through 9.7.2 are affected. Versions before OTP 17.0 (inets before 5.10) are uncertain.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity, and the vulnerability is publicly known but not listed in CISA’s KEV catalog. The EPSS score is not available, so the historical exploitation probability is unknown. Attackers can exploit this unauthenticatedly over the network by crafting a large Content-Length header and pausing transmission, leading to resource exhaustion and service disruption.

Generated by OpenCVE AI on September 1, 2026 at 15:52 UTC.

Remediation

Vendor Workaround

* Set minimum_bytes_per_second in the httpd configuration, for example {minimum_bytes_per_second, 200}. This arms a periodic byte-rate check that terminates a connection which has stopped delivering data, reclaiming the parked worker. The check is disabled by default. * Place a reverse proxy in front of httpd that enforces its own body-read timeout, such as client_body_timeout in nginx. * Restrict access to the server to trusted clients where the deployment allows it.

OpenCVE Recommended Actions

  • Upgrade to Erlang OTP version 27.3.4.17 or newer (or 28.5.0.6, 29.0.6, or later) where the bug is fixed
  • Configure the httpd application to set a non‑zero minimum_bytes_per_second, such as {minimum_bytes_per_second,200}, which re‑arms the connection if the byte rate falls below the threshold
  • Deploy a reverse proxy (e.g., nginx) in front of the httpd instance and configure a body‑read timeout like client_body_timeout to terminate stalled connections
  • Limit connections to trusted clients or isolate the server in a secure network segment to reduce exposure

Generated by OpenCVE AI on September 1, 2026 at 15:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Erlang erlang/otp
Erlang otp
Vendors & Products Erlang erlang/otp
Erlang otp
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete. httpd_request_handler:handle_info/2 cancels the request timeout as soon as a parse step succeeds, which includes the headers, and the clause that handles a decoder asking for more data re-arms the socket with {active, once} without setting any further timer. httpd_request:whole_body/2 returns such a continuation whenever the bytes received are fewer than the announced Content-Length, so a well-formed request that stops mid-body leaves the worker waiting indefinitely. The periodic byte-rate check that would reclaim it is armed only when minimum_bytes_per_second is configured, which it is not by default. Repeating this across connections occupies every worker permitted by max_clients and denies service to legitimate clients at negligible bandwidth cost. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Title httpd applies no timeout while receiving a request body, parking a worker on a stalled client
First Time appeared Erlang
Erlang erlang\/otp
Weaknesses CWE-772
CPEs cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Vendors & Products Erlang
Erlang erlang\/otp
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp
cve-icon MITRE

Status: PUBLISHED

Assigner: EEF

Published:

Updated: 2026-09-08T01:09:23.481Z

Reserved: 2026-08-17T12:45:01.757Z

Link: CVE-2026-71380

cve-icon Vulnrichment

Updated: 2026-09-01T15:52:05.892Z

cve-icon NVD

Status : Deferred

Published: 2026-09-01T15:17:24.637

Modified: 2026-09-08T01:17:53.310

Link: CVE-2026-71380

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T16:00:13Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime