CVE-2026-55951: Erlang/OTP httpc memory exhaustion via unbounded response headers

CVE-2026-55951 · Severity: info · CVSS 8.2 · Published 2026-09-01

The Erlang/OTP httpc HTTP client library does not limit the total size of response headers it accepts from servers. A malicious or compromised server can send an extremely large number of headers, forcing the client process to consume unbounded memory until the system runs out of RAM or the BEAM virtual machine crashes. This affects any application that uses httpc to fetch data from untrusted servers, including those accessed via redirects or man-in-the-middle scenarios.

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-55951 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55951 being exploited in the wild.
How severe is CVE-2026-55951?
Informational severity, with a CVSS score of 8.2, published 1 September 2026.
Which products and versions are affected?
Erlang Inets 5.10 through 9.3.2.6, 9.4 through 9.6.2.2, 9.7 through 9.7.1; Erlang OTP 17.0 through 27.3.4.16, 28.0 through 28.5.0.5, 29.0 through 29.0.5.
Is there a fix for CVE-2026-55951?
A patch was published on 2026-09-01: Patches released for OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55951 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55951?
Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a resource exhaustion vulnerability (CWE-770) in the httpc HTTP client module of Erlang/OTP. The root cause is that httpc_response:parse_headers/6 accumulates all response headers into a list before performing length validation, which only triggers after receiving the final CRLF CRLF delimiter. The max_header_size option defaults to 'nolimit'. An attacker can exploit this by sending a large number of headers or headers with large values over the network without authentication. A proof-of-concept demonstration using 100,000 headers of ~4000 bytes each caused a client VM to allocate over 13 GB of memory in under 30 seconds. Patches have been released for OTP 27.3.4.17, 28.5.0.6, and 29.0.6.

Affected products

  • Erlang OTP 17.0 through 27.3.4.16, 28.0 through 28.5.0.5, 29.0 through 29.0.5
  • Erlang inets 5.10 through 9.3.2.6, 9.4 through 9.6.2.2, 9.7 through 9.7.1

Timeline

  • 2026-09-01: disclosed: CVE-2026-55951 published
  • 2026-09-01: patched: Patches released for OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.