# CVE-2026-71562: Erlang/OTP inets httpc unbounded numeric header conversion denial of service

Source: https://junglewise.ai/threats/cve-2026-71562-erlang-otp-inets-httpc-unbounded-numeric-header-conversion-denial  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71562 · Severity: info · CVSS 6.3 · Published 2026-09-01

Erlang/OTP's built-in HTTP client library (inets httpc) fails to validate the size of numeric headers before converting them to integers. A malicious or compromised HTTP server can send extremely long digit sequences in headers like Content-Length or Retry-After, forcing the client to spend hundreds of milliseconds performing expensive arbitrary-precision arithmetic, degrading application availability.

Technologies: [Erlang Inets](https://junglewise.ai/threats/technologies/inets), [Erlang OTP](https://junglewise.ai/threats/technologies/otp). Vendors: [Erlang](https://junglewise.ai/threats/vendors/erlang).

## Quick answers

**Is CVE-2026-71562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71562 being exploited in the wild.

**How severe is CVE-2026-71562?** Informational severity, with a CVSS score of 6.3, published 1 September 2026.

**Which products and versions are affected?** Erlang Inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2; Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6.

**Is there a fix for CVE-2026-71562?** A patch was published on 2026-09-01: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71562 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-71562?** Check whether you run Erlang Inets or Erlang OTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in httpc_handler.erl, httpc_response.erl, specifically in the functions httpc_handler:handle_http_body/2, httpc_response:format_response/1, and httpc_response:get_ms_from_retry_after/1. These functions convert server-supplied numeric header values (Content-Length, Retry-After) using list_to_integer/1 without first validating input length. An attacker can send headers with up to ~1.26 million digits, causing the conversion to consume hundreds of milliseconds of arbitrary-precision arithmetic per HTTP response. The attack requires a network-reachable HTTP server under attacker control or compromise, and no authentication. This causes denial of service by exhausting the requesting process's CPU time. Patches are available in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 or later.

## Affected products

- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2

## Timeline

- 2026-09-01: disclosed
- 2026-09-01: patched: Patches released in OTP 27.3.4.17, 28.5.0.6, and 29.0.6

## References

- [https://github.com/](https://github.com/)
- [https://cna.erlef.org/cves/CVE-2026-71562.html](https://cna.erlef.org/cves/CVE-2026-71562.html)

## Related threats

- [Erlang OTP erl_tar infinite loop in GNU sparse member handling](https://junglewise.ai/threats/cve-2026-96596-loop-with-unreachable-exit-condition-infinite-loop-vulnerability)
- [Erlang OTP ssl denial of service in TLS 1.3 NewSessionTicket](https://junglewise.ai/threats/cve-2026-94200-improper-validation-of-consistency-within-input-vulnerability-in)
- [Erlang/OTP ssl TLS 1.3 server authentication bypass](https://junglewise.ai/threats/cve-2026-89422-key-exchange-without-entity-authentication-vulnerability-in)
- [Erlang/OTP SSH unbounded session channel allocation denial of service](https://junglewise.ai/threats/cve-2026-68956-allocation-of-resources-without-limits-or-throttling)
- [Erlang OTP asn1 OBJECT IDENTIFIER decoder algorithmic complexity denial of service](https://junglewise.ai/threats/cve-2026-65634-inefficient-algorithmic-complexity-in-the-erlang-otp-asn1-object)