CVE-2026-55951

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1

Description The httpc HTTP client fails to enforce a limit on the total size of response headers received from a server because the max header size option defaults to nolimit. The function httpc response:parse headers/6 accumulates all headers into a list before performing a length check, which only occurs after the terminating CRLF CRLF is received. A malicious or compromised server can send an excessive number of headers or headers with very large values, leading to unbounded memory allocation that can exhaust system resources or crash the BEAM VM (the Erlang Virtual Machine). This issue affects any application using httpc:request/4,5 to connect to untrusted servers and requires no authentication. A proof-of-concept demonstrated that 100,000 headers of approximately 4000 bytes each could cause the client VM to allocate over 13 GB of memory in less than 30 seconds.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later. Update inets to version 9.3.2.7 or later. Update inets to version 9.6.2.3 or later. Update inets to version 9.7.2 or later. Restrict the use of httpc to trusted servers only and avoid fetching resources from arbitrary or user-supplied URLs. Apply operating-system memory limits, such as cgroups or ulimit, to contain the impact of a runaway client process. Use an alternative HTTP client library that enforces a response header size limit.