Executive brief
The Erlang OTP inets application provides an HTTP server component used in production systems to handle web traffic. The httpd server fails to enforce configured limits on request body size when processing HTTP chunked transfer encoding, allowing attackers to send arbitrarily large payloads and exhaust server memory, resulting in denial of service.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) in the inets httpd HTTP server where the max_body_size configuration limit is not applied to chunked HTTP requests. An unauthenticated network attacker can send a series of chunked HTTP POST/PUT requests with individually small chunks that collectively exceed the configured body-size limit, causing unbounded memory allocation and eventual denial of service. The vulnerability affects OTP versions 17.0–27.3.4.16, 28.0–28.5.0.5, and 29.0–29.0.5. Patches are available in OTP 27.3.4.17, 28.5.0.6, and 29.0.6 respectively.
Affected products
- Erlang OTP 17.0 before 27.3.4.17, 28.0 before 28.5.0.6, 29.0 before 29.0.6
- Erlang inets 5.10 before 9.3.2.7, 9.4 before 9.6.2.3, 9.7 before 9.7.2
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: OTP 27.3.4.17, 28.5.0.6, 29.0.6 released