CVE-2026-69664

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions 18.1.4 through 27.3.4.16 Erlang/OTP versions 28.0 through 28.5.0.5 Erlang/OTP versions 29.0 through 29.0.5

Description A resource leak in the inets httpd module allows an unauthenticated remote attacker to cause a denial of service. By sending a request with a chunked body where the chunk-size line is not a hexadecimal number, and ensuring this line arrives in a separate write from the headers, the attacker can cause the worker serving the connection to be trapped. Specifically, the httpd request handler:handle info/2 function converts a throw from http chunk:decode size/4 into a return value, causing the worker to wait indefinitely for data that never arrives. Since the request timeout is cancelled after headers are accepted and the byte-rate check is disabled by default, repeating this request across multiple connections can occupy all available workers, denying service to legitimate clients.

Recommendations Update Erlang/OTP to version 27.3.4.17 or later. Update Erlang/OTP to version 28.5.0.6 or later. Update Erlang/OTP to version 29.0.6 or later. Set minimum bytes per second in the httpd configuration to a positive value, such as {minimum bytes per second, 200}, to enable the periodic byte-rate check that reclaims parked workers. Place a reverse proxy in front of httpd to validate chunked transfer encoding and reject malformed chunk framing. Restrict server access to trusted clients.