CVE-2026-70399

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5 inets versions 5.10 through 9.3.2.6 inets versions 9.4 through 9.6.2.2 inets versions 9.7 through 9.7.1

Description An unauthenticated remote attacker can cause a denial of service by opening and holding a large number of connections. This occurs because the max clients option, which is documented to default to 150, is not applied if not explicitly set, allowing an unlimited number of simultaneous connections. The issue resides in the httpd manager:handle new connection/4 function, which uses httpd util:lookup/2 to read the option. When the key is absent, it returns undefined, causing the connection guard to always hold true. Consequently, each connection consumes a worker process and a socket, leading to the exhaustion of processes, memory, and file descriptors.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later. Update inets to version 9.3.2.7 or later. Update inets to version 9.6.2.3 or later. Update inets to version 9.7.2 or later. Set max clients explicitly in the httpd configuration, such as {max clients, 150}. Limit concurrent connections using a reverse proxy or firewall connection-count and connection-rate rules. Restrict server access to trusted clients where possible.