CVE-2026-70399: Erlang OTP inets httpd resource exhaustion via unlimited connections

CVE-2026-70399 · Severity: info · CVSS 8.7 · Published 2026-09-01

Erlang OTP's built-in HTTP server (inets httpd) fails to enforce a documented default connection limit, allowing unauthenticated attackers to exhaust server resources through denial-of-service. An attacker can open and hold large numbers of simultaneous connections without sending valid requests or authenticating, causing the server to run out of worker processes, memory, and file descriptors. Organizations running Erlang services without explicit connection limits face service outages and unavailability.

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-70399 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-70399 being exploited in the wild.
How severe is CVE-2026-70399?
Informational severity, with a CVSS score of 8.7, published 1 September 2026.
Which products and versions are affected?
Erlang Inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2; Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.
Is there a fix for CVE-2026-70399?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-70399 attacked?
It is attacked over the network.
Am I affected by CVE-2026-70399?
Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a resource exhaustion vulnerability (CWE-770) in the httpd connection acceptance logic. The vulnerable code in httpd_manager:handle_new_connection/4 uses httpd_util:lookup/2 to read the max_clients option, which returns the atom 'undefined' when the option is not explicitly configured, rather than applying the documented default of 150. Due to Erlang term ordering (integers sort before atoms), the guard condition Count =< Max evaluates to true for any integer connection count when Max is 'undefined', allowing unlimited connections. Each accepted connection consumes a worker process and socket, exhausting system resources. The attack requires only network reachability; no authentication, valid HTTP requests, or user interaction are needed. Servers that explicitly configure max_clients are unaffected. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.

Affected products

  • Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
  • Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2

Timeline

  • 2026-09-01: disclosed
  • 2026-09-08: advisory: CNA advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.