Executive brief
Erlang/OTP's built-in HTTP client library (inets httpc) fails to validate the size of numeric headers before converting them to integers. A malicious or compromised HTTP server can send extremely long digit sequences in headers like Content-Length or Retry-After, forcing the client to spend hundreds of milliseconds performing expensive arbitrary-precision arithmetic, degrading application availability.
Technical details
The vulnerability exists in httpc_handler.erl, httpc_response.erl, specifically in the functions httpc_handler:handle_http_body/2, httpc_response:format_response/1, and httpc_response:get_ms_from_retry_after/1. These functions convert server-supplied numeric header values (Content-Length, Retry-After) using list_to_integer/1 without first validating input length. An attacker can send headers with up to ~1.26 million digits, causing the conversion to consume hundreds of milliseconds of arbitrary-precision arithmetic per HTTP response. The attack requires a network-reachable HTTP server under attacker control or compromise, and no authentication. This causes denial of service by exhausting the requesting process's CPU time. Patches are available in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 or later.
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6