Executive brief
Erlang/OTP's inets httpd web server contains a flaw in HTTP chunked transfer encoding handling that allows remote attackers to cause denial of service without authentication. By sending malformed chunked requests, attackers can exhaust all worker threads, preventing legitimate users from accessing the server.
Technical details
The vulnerability exists in the HTTP chunked body decoder within httpd_request_handler and http_chunk modules. When a chunk-size line arrives in a separate write from the request headers and contains invalid hexadecimal data, an error thrown by http_chunk:decode_size/4 is incorrectly caught as a return value rather than propagated as an exception. This causes the worker thread to enter a waiting state for data that never arrives. The request timeout is disabled after headers are accepted, and the byte-rate check is not configured by default, leaving no mechanism to recover the hung worker. An unauthenticated attacker can repeat this attack across multiple connections to exhaust the server's worker thread pool, achieving denial of service.
Affected products
- Erlang/OTP OTP 18.1.4 before 27.3.4.17, 28 before 28.5.0.6, 29 before 29.0.6
- Erlang/OTP inets 6.0.3 before 9.3.2.7, 9.6 before 9.6.2.3, 9.7 before 9.7.2
Timeline
- 2026-09-01: disclosed