Executive brief
Erlang OTP's built-in HTTP server (inets httpd) fails to enforce a documented default connection limit, allowing unauthenticated attackers to exhaust server resources through denial-of-service. An attacker can open and hold large numbers of simultaneous connections without sending valid requests or authenticating, causing the server to run out of worker processes, memory, and file descriptors. Organizations running Erlang services without explicit connection limits face service outages and unavailability.
Technical details
This is a resource exhaustion vulnerability (CWE-770) in the httpd connection acceptance logic. The vulnerable code in httpd_manager:handle_new_connection/4 uses httpd_util:lookup/2 to read the max_clients option, which returns the atom 'undefined' when the option is not explicitly configured, rather than applying the documented default of 150. Due to Erlang term ordering (integers sort before atoms), the guard condition Count =< Max evaluates to true for any integer connection count when Max is 'undefined', allowing unlimited connections. Each accepted connection consumes a worker process and socket, exhausting system resources. The attack requires only network reachability; no authentication, valid HTTP requests, or user interaction are needed. Servers that explicitly configure max_clients are unaffected. Patches are available in OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2
Timeline
- 2026-09-01: disclosed
- 2026-09-08: advisory: CNA advisory published