Erlang OTP inets CVE-2026-70399

The vulnerability requires only that the target system runs Erlang/OTP's inets httpd component and has not explicitly set the max_clients option in its httpd configuration block. Establishing a TCP connection to the httpd listen port is sufficient; no valid HTTP request body, no HTTP headers, no authentication credential, and no session state are required - the accept path is triggered before any application-layer parsing occurs. The single, concrete limiting condition is the absence of an explicit max_clients integer value in configuration: any server that has set this option - regardless of the value - is fully protected, because the correctly-typed integer takes the safe code path. The vulnerability has been present since OTP 17.0, so long-running deployments that were provisioned before hardening guidance existed are at elevated risk. Attack impact is limited to availability of the inets httpd process and the hosting Erlang node; there is no confidentiality or integrity exposure.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately captures the threat model: no authentication, no special network positioning, and no user interaction are required, with availability as the sole impact. No EPSS score was provided, preventing quantified exploitation-probability assessment, but the attack requires only a TCP connection loop achievable with commodity tooling, making empirical probability likely non-trivial. No CISA KEV listing or public proof-of-concept was identified at time of analysis, suggesting exploitation has not been widely observed. The critical limiting factor is that only servers lacking an explicit max_clients configuration are vulnerable; this is a misconfiguration by omission that has existed since OTP 17.0, meaning long-running deployments that predate the inets hardening guide are the primary risk population. Operators who have followed the hardening guide are fully protected by their existing configuration, so real-world exposure is narrower than the CVSS score alone implies. The risk-to-effort ratio for exploitation is high - a complete DoS requires no specialised knowledge - making this a genuine operational priority for affected deployments.

An attacker opens a large number of concurrent TCP connections to a publicly exposed Erlang/OTP inets httpd server that has not explicitly configured max_clients, holding each connection open without transmitting any HTTP request. Because the connection-count guard unconditionally accepts every connection due to the Erlang term-ordering bug, the server spawns a worker process and allocates a socket per accepted connection until the Erlang node exhausts its process table, available memory, or operating-system file descriptor limit, rendering the service completely unresponsive to legitimate clients. No public exploit code has been identified at time of analysis, but the attack requires only a basic TCP connection-flooding script executable with standard tooling.