httpc does not bound server-supplied numeric header values before integer conversion

...

httpc memory exhaustion via unbounded response header accumulation

...

Linux Distros Unpatched Vulnerability : CVE-2026-55951

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to...

AZL-98481 CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-71562

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

AZL-98454 CVE-2026-55951 affecting package erlang for versions less than 26.2.5.21-6

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

DEBIAN-CVE-2026-55951

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

CVE-2026-55951

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

UBUNTU-CVE-2026-55951

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

CVE-2026-55951

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

CVE-2026-55951

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

EUVD-2026-69228

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

EEF-CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation

Summary The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after t...

CVE-2026-55951 httpc memory exhaustion via unbounded response header accumulation

The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The maxheadersize option defaults to nolimit, and httpcresponse:parseheaders/6 accumulates every header into a list before the length check runs which only fires after the...

CVE-2026-55951

The Erlang/OTP httpc HTTP client (inets package) does not enforce a limit on the total size of response headers. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates all headers into a list before the length check fires (only after the terminating CRLF CR...

EEF-CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion

Summary Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied...

EUVD-2026-69224

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...

CVE-2026-71562 httpc does not bound server-supplied numeric header values before integer conversion

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpchandler.erl converts the server-supplied Content-Length wit...