CVE-2026-71380

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 17.0 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5

Description A resource leak in the inets httpd component allows an unauthenticated remote attacker to cause a denial of service. By sending valid request headers with a large Content-Length and stalling before the body is complete, an attacker can leave worker processes waiting indefinitely. This occurs because httpd request handler:handle info/2 cancels the request timeout after headers are parsed, and httpd request:whole body/2 fails to set a new timer when more data is required. Since the minimum bytes per second check is disabled by default, repeating this action across multiple connections can exhaust all workers permitted by max clients, blocking legitimate traffic.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later. Set minimum bytes per second in the httpd configuration (e.g., {minimum bytes per second, 200}) to enable the periodic byte-rate check. Deploy a reverse proxy in front of httpd to enforce body-read timeouts. Restrict server access to trusted clients.