CVE-2026-71380: Erlang/OTP inets httpd denial of service via stalled request body

CVE-2026-71380 · Severity: info · CVSS 8.7 · Published 2026-09-01

Erlang's inets httpd module, used as an embedded HTTP server in many Erlang applications, fails to enforce a timeout while receiving an HTTP request body. An unauthenticated remote attacker can send valid request headers with a large Content-Length but never send the body, causing worker threads to wait indefinitely. By repeating this attack across multiple connections, an attacker can exhaust all available worker threads and prevent legitimate users from accessing the service.

Technologies: Erlang Inets, Erlang OTP. Vendors: Erlang.

Quick answers

Is CVE-2026-71380 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71380 being exploited in the wild.
How severe is CVE-2026-71380?
Informational severity, with a CVSS score of 8.7, published 1 September 2026.
Which products and versions are affected?
Erlang Inets 5.10 to 9.3.2.6, 9.4 to 9.6.2.2, 9.7 to 9.7.1; Erlang OTP 17.0 to 27.3.4.16, 28.0 to 28.5.0.5, 29.0 to 29.0.5.
Is there a fix for CVE-2026-71380?
A patch was published on 2026-09-01: Patches available for OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+ Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71380 attacked?
It is attacked over the network.
Am I affected by CVE-2026-71380?
Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a resource exhaustion vulnerability (CWE-772) in the httpd_request_handler and httpd_request modules. The root cause is that the request timeout is cancelled as soon as headers are successfully parsed, and socket re-arming in the body-receiving phase does not set a new timer. The whole_body/2 function returns a continuation when fewer bytes are received than the announced Content-Length, leaving the worker parked indefinitely waiting for more data. The periodic byte-rate check (minimum_bytes_per_second) that could reclaim the worker is disabled by default. An unauthenticated remote attacker with network access can exploit this by sending partial HTTP requests, occupying all max_clients workers and causing denial of service to legitimate traffic at negligible bandwidth cost. Patches are available for affected branches: OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.

Affected products

  • Erlang OTP 17.0 to 27.3.4.16, 28.0 to 28.5.0.5, 29.0 to 29.0.5
  • Erlang inets 5.10 to 9.3.2.6, 9.4 to 9.6.2.2, 9.7 to 9.7.1

Timeline

  • 2026-09-01: disclosed: Vulnerability published on CVE database
  • 2026-09-01: patched: Patches available for OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.