Executive brief
Erlang's inets httpd module, used as an embedded HTTP server in many Erlang applications, fails to enforce a timeout while receiving an HTTP request body. An unauthenticated remote attacker can send valid request headers with a large Content-Length but never send the body, causing worker threads to wait indefinitely. By repeating this attack across multiple connections, an attacker can exhaust all available worker threads and prevent legitimate users from accessing the service.
Technical details
This is a resource exhaustion vulnerability (CWE-772) in the httpd_request_handler and httpd_request modules. The root cause is that the request timeout is cancelled as soon as headers are successfully parsed, and socket re-arming in the body-receiving phase does not set a new timer. The whole_body/2 function returns a continuation when fewer bytes are received than the announced Content-Length, leaving the worker parked indefinitely waiting for more data. The periodic byte-rate check (minimum_bytes_per_second) that could reclaim the worker is disabled by default. An unauthenticated remote attacker with network access can exploit this by sending partial HTTP requests, occupying all max_clients workers and causing denial of service to legitimate traffic at negligible bandwidth cost. Patches are available for affected branches: OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+.
Affected products
- Erlang OTP 17.0 to 27.3.4.16, 28.0 to 28.5.0.5, 29.0 to 29.0.5
- Erlang inets 5.10 to 9.3.2.6, 9.4 to 9.6.2.2, 9.7 to 9.7.1
Timeline
- 2026-09-01: disclosed: Vulnerability published on CVE database
- 2026-09-01: patched: Patches available for OTP 27.3.4.17+, 28.5.0.6+, and 29.0.6+