EUVD-2026-69228

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

EEF-CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation

Summary The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after t...

CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

CVE-2026-71380

CVE-2026-71380 is a Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd . An unauthenticated remote attacker can trigger a denial of service by sending valid request headers declaring a large Content-Length and then stalling before the body is complete. In...

EUVD-2026-69226

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

EEF-CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client

Summary Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

CVE-2026-71380 httpd applies no timeout while receiving a request body, parking a worker on a stalled client

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

CVE-2026-71380

Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending valid request headers with a large Content-Length and then stalling before the body is complete...

EEF-CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion

Summary Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied...

EUVD-2026-69224

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

CVE-2026-70399

Erlang/OTP inets httpd contains a denial-of-service vulnerability (CVSS 4.0: 8.7 HIGH ). The accept gate in httpd_manager:handle_new_connection/4 reads max_clients via httpd_util:lookup/2, which returns undefined when the key is absent instead of the documented default of 150. Because Erlang term...

EUVD-2026-69223

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets hardeni...

EEF-CVE-2026-70399 httpd does not enforce the documented default max_clients connection limit

Summary Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The maxclients option is documented to default to 150, and the inets...