Erlang/OTP httpc CVE-2026-55951

The target application must invoke httpc:request/4 or httpc:request/5 - Erlang/OTP's built-in HTTP client - and connect to a server the attacker can control, redirect to, or intercept via man-in-the-middle. No authentication to the Erlang application is required; the vulnerability is entirely client-side, triggered by the server's response. The default configuration (max_header_size set to nolimit) is vulnerable without any operator action. Applications running unpatched OTP versions that have explicitly set max_header_size to a positive integer on every httpc:request call would be protected, but because nolimit is the historic default, nearly all unpatched deployments are exposed. Exploitation is not possible against applications that exclusively contact trusted internal servers that the attacker cannot reach or influence.

The CVSS 4.0 score of 8.2 with AV:N/AC:L/AT:P/PR:N/UI:N/VA:H accurately reflects the threat profile: no authentication is required and the attack is network-delivered from any server the application contacts, but AT:P (attack requirements present) captures the prerequisite that an attacker must control or impersonate a reachable server. The sole impact is availability (VA:H); confidentiality and integrity are unaffected. No EPSS data was provided and this CVE is absent from CISA KEV, indicating no confirmed widespread active exploitation at time of analysis. Despite the lack of KEV listing, real-world risk is elevated because the detailed PoC (quantities and timing) is embedded in the official advisory, dramatically lowering the exploitation barrier for any attacker who can position themselves as or redirect to a server the Erlang application calls. Risk is highest for Erlang and Elixir applications that issue outbound HTTP requests to user-supplied, third-party, or otherwise untrusted URLs; applications restricted to controlled internal endpoints are significantly less exposed.

An attacker operates or compromises an HTTP server reachable by the target Erlang application, or performs an HTTP redirect or man-in-the-middle substitution to point the client at a malicious endpoint. The server responds to any httpc request with 100,000 HTTP headers each containing approximately 4,000 bytes of arbitrary data. Within 30 seconds the BEAM process heap exhausts available system RAM (13+ GB in the documented PoC), causing the Erlang node to crash and denying service to all applications hosted on it.