Erlang/OTP inets EUVD-2026-69224

Exploitation requires that the target application uses Erlang/OTP's inets httpc module for outbound HTTP requests and that the attacker controls or has compromised at least one HTTP server the client contacts. No authentication to the victim system is needed - the attack is entirely server-side. The vulnerability is triggered at three code sites: Content-Length conversion in httpc_handler.erl, Content-Length in httpc_response:format_response/1, and Retry-After in httpc_response:get_ms_from_retry_after/1 (the last requiring only a leading digit). What limits exploitation: the attacker must occupy a server-side position in the HTTP conversation - passive network observers cannot trigger this. Applications that use httpc exclusively against fully controlled internal endpoints are not exposed. Setting max_body_size does NOT prevent exploitation because list_to_integer/1 is called before the bound comparison and the option defaults to nolimit. Applications that use alternative HTTP clients (e.g., hackney, gun, ibrowse) rather than httpc are unaffected.

The CVSS 4.0 score of 6.3 with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N accurately represents a narrow, availability-only impact with a specific targeting prerequisite. AT:P (Attack Target: Partial) correctly captures that the attacker must control or compromise an HTTP server the victim client connects to - without that server-side position, exploitation is impossible. The impact is degraded throughput (hundreds of milliseconds stalled per response), not a crash or complete service outage, which aligns with VA:L. No EPSS score was provided in the input, so quantitative exploitation probability cannot be stated; however, the mechanical simplicity of the attack - return a digit string as a header - suggests low complexity once the server-side prerequisite is met. There is no KEV listing and no POC code reported. Real-world priority should be tiered by deployment context: applications using httpc to call third-party, user-controlled, or SSRF-reachable servers carry meaningfully higher exposure than those calling only fully controlled internal endpoints; even a mid-sized operations team should treat this as a routine patch-cycle item rather than an emergency, given the AT:P constraint. CVSS signals and description are consistent - no conflicting data detected.

An attacker who operates or compromises an HTTP server that an Erlang application queries via httpc crafts responses in which the Content-Length or Retry-After header contains a string of approximately 1.26 million ASCII digits. Each such response causes the httpc_handler process to spend hundreds of milliseconds performing arbitrary-precision integer arithmetic before the value is discarded; by returning this header on every response, the attacker can continually stall any OTP process making outbound httpc requests, degrading its throughput without triggering any crash or error. No public exploit code has been identified at time of analysis.