CVE-2026-71562 - Vulnerability Details

- httpc does not bound server-supplied numeric header values before integer conversion

Description

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits.

httpc_handler.erl converts the server-supplied Content-Length with list_to_integer/1 before comparing it against max_body_size, so the size check cannot protect the conversion, and the option defaults to nolimit in any case. The same unbounded conversion appears in httpc_response:format_response/1 for Content-Length and in httpc_response:get_ms_from_retry_after/1 for Retry-After, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility.

This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.

Published: 2026-09-01

Score: 6.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is in the Erlang/OTP httpc client, where numeric header values such as Content‑Length and Retry‑After are converted to integers without prior validation, an instance of CWE‑1284. A malicious or compromised HTTP server can send a very long sequence of digits; the list_to_integer function performs an expensive arbitrary‑precision conversion that consumes hundreds of milliseconds per response, effectively degrading availability. The CVSS score of 6.3 indicates a moderate severity that can lead to resource exhaustion.

Affected Systems

The issue affects Erlang/OTP releases from OTP 17.0 through OTP 27.3.4.17, OTP 28.0 through OTP 28.5.0.6, and OTP 29.0 through OTP 29.0.6. This corresponds to inets component versions 5.10 through 9.3.2.7, 9.4 through 9.6.2.3, and 9.7 through 9.7.2.

Risk and Exploitability

Risk is moderate; the vulnerability can be exploited by a controlling or compromised HTTP server that communicates with an Erlang/OTP client. An attacker may send an extremely long numeric header, causing the client to expend significant CPU time converting the value and potentially leading to denial of service for the affected process. The public exploit status is not stated in the provided data. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector is a remote attacker that serves as an HTTP target to the client, which is inferred from the description that the driver expects server‑supplied headers.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Erlang

OTP

unaffected

Version	Status	Constraints
`0`	unknown	< 17.0
`17.0`	affected	< 27.3.4.17
`28.0`	affected	< 28.5.0.6
`29.0`	affected	< 29.0.6

Erlang

OTP

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10
`5.10`	affected	< 9.3.2.7
`9.4`	affected	< 9.6.2.3
`9.7`	affected	< 9.7.2

Erlang

OTP

unaffected

Version	Status	Constraints
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	< *

No data.

Vendor Product Confidence Versions

Erlang

Erlang/otp

95%

Version	Status	Scheme	Platform
`[17.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	generic	—
`[5.10,9.3.2.7)`	affected	generic	—
`[9.4,9.6.2.3)`	affected	generic	—
`[9.7,9.7.2)`	affected	generic	—
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	code_commit	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[17.0,27.3.4.17)`	affected	generic	—
`[28.0,28.5.0.6)`	affected	generic	—
`[29.0,29.0.6)`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`[5.10,9.3.2.7)`	affected	generic	—
`[9.4,9.6.2.3)`	affected	generic	—
`[9.7,9.7.2)`	affected	generic	—

Erlang

Otp

100%

Version	Status	Scheme	Platform
`84adefa331c4159d432d22840663c38f155cd4c1`	affected	code_commit	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Erlang/OTP to a release newer than OTP 27.3.4.17 (or OTP 28.5.0.6, or OTP 29.0.6) so that the httpc numeric header conversion is bounded.
Configure the httpc client's max_body_size option to a reasonable limit to prevent excessive processing of large headers.
If upgrade is not possible, monitor network traffic for unusually large numeric header values and terminate connections that exceed a safe threshold.

Generated by OpenCVE AI on September 1, 2026 at 16:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00342.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://cna.erlef.org/cves/CVE-2026-71562.html
https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d
https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa
https://github.com/erlang/otp/security/advisories/GHSA-cqx9-9hq6-m8wf
https://osv.dev/vulnerability/EEF-CVE-2026-71562
https://www.erlang.org/doc/system/versions.html#order-of-versions

History

Tue, 01 Sep 2026 22:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Erlang erlang/otp Erlang otp
Vendors & Products		Erlang erlang/otp Erlang otp
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 01 Sep 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpc_handler.erl converts the server-supplied Content-Length with list_to_integer/1 before comparing it against max_body_size, so the size check cannot protect the conversion, and the option defaults to nolimit in any case. The same unbounded conversion appears in httpc_response:format_response/1 for Content-Length and in httpc_response:get_ms_from_retry_after/1 for Retry-After, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Title		httpc does not bound server-supplied numeric header values before integer conversion
First Time appeared		Erlang Erlang erlang\/otp
Weaknesses		CWE-1284
CPEs		cpe:2.3:a:erlang:erlang\/otp::::::::
Vendors & Products		Erlang Erlang erlang\/otp
References		https://cna.erlef.org/cves/CVE-2026-71562.html https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa https://github.com/erlang/otp/security/advisories/GHSA-cqx9-9hq6-m8wf https://osv.dev/vulnerability/EEF-CVE-2026-71562 https://www.erlang.org/doc/system/versions.html#order-of-versions
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}`

Subscriptions

Erlang Erlang/otp Erlang\/otp Otp

MITRE

Status: PUBLISHED

Assigner: EEF

Published: 2026-09-01T14:33:41.833Z

Updated: 2026-09-08T01:09:37.049Z

Reserved: 2026-08-07T15:15:01.474Z

Link: CVE-2026-71562

Vulnrichment

Updated: 2026-09-01T15:53:20.563Z

NVD

Status : Deferred

Published: 2026-09-01T15:17:24.883

Modified: 2026-09-08T01:17:53.543

Link: CVE-2026-71562

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-01T17:00:17Z

Weaknesses

CWE-1284
Improper Validation of Specified Quantity in Input

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object