# CVE-2026-55951: Erlang/OTP httpc memory exhaustion via unbounded response headers

Source: https://junglewise.ai/threats/cve-2026-55951-erlang-otp-httpc-memory-exhaustion-via-unbounded-response-headers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55951 · Severity: info · CVSS 8.2 · Published 2026-09-01

The Erlang/OTP httpc HTTP client library does not limit the total size of response headers it accepts from servers. A malicious or compromised server can send an extremely large number of headers, forcing the client process to consume unbounded memory until the system runs out of RAM or the BEAM virtual machine crashes. This affects any application that uses httpc to fetch data from untrusted servers, including those accessed via redirects or man-in-the-middle scenarios.

Technologies: [Erlang Inets](https://junglewise.ai/threats/technologies/inets), [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-55951 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55951 being exploited in the wild.

**How severe is CVE-2026-55951?** Informational severity, with a CVSS score of 8.2, published 1 September 2026.

**Which products and versions are affected?** Erlang Inets 5.10 through 9.3.2.6, 9.4 through 9.6.2.2, 9.7 through 9.7.1; Erlang OTP 17.0 through 27.3.4.16, 28.0 through 28.5.0.5, 29.0 through 29.0.5.

**Is there a fix for CVE-2026-55951?** A patch was published on 2026-09-01: Patches released for OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55951 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55951?** Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a resource exhaustion vulnerability (CWE-770) in the httpc HTTP client module of Erlang/OTP. The root cause is that httpc_response:parse_headers/6 accumulates all response headers into a list before performing length validation, which only triggers after receiving the final CRLF CRLF delimiter. The max_header_size option defaults to 'nolimit'. An attacker can exploit this by sending a large number of headers or headers with large values over the network without authentication. A proof-of-concept demonstration using 100,000 headers of ~4000 bytes each caused a client VM to allocate over 13 GB of memory in under 30 seconds. Patches have been released for OTP 27.3.4.17, 28.5.0.6, and 29.0.6.

## Affected products

- Erlang OTP 17.0 through 27.3.4.16, 28.0 through 28.5.0.5, 29.0 through 29.0.5
- Erlang inets 5.10 through 9.3.2.6, 9.4 through 9.6.2.2, 9.7 through 9.7.1

## Timeline

- 2026-09-01: disclosed: CVE-2026-55951 published
- 2026-09-01: patched: Patches released for OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-55951.html](https://cna.erlef.org/cves/CVE-2026-55951.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)