Erlang/OTP inets EUVD-2026-69226

The target application must be using Erlang/OTP's inets httpd as its HTTP server; applications using Cowboy, Elli, or any other Erlang HTTP library are not affected. The vulnerable path is triggered by any HTTP request whose Content-Length header declares more bytes than the attacker actually transmits - no authentication, no special endpoint, and no non-default server feature needs to be enabled. The default configuration is directly exploitable because minimum_bytes_per_second is not set by default, leaving no safeguard against stalled body reads. Exploitation is bounded to OTP versions 17.0 through the fixed releases (27.3.4.17, 28.5.0.6, 29.0.6); status of OTP before 17.0 is explicitly unknown per vendor. The attacker requires only TCP-level network access to the httpd listener port.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) accurately reflects the low barrier to exploitation: no authentication, no user interaction, and trivially automatable at near-zero attacker bandwidth. The availability impact is High because a single attacker can exhaust the entire inets httpd worker pool (bounded by max_clients) and deny service to all legitimate clients. No EPSS score was provided in the input intelligence, so exploitation probability cannot be quantified numerically. Neither KEV listing nor public POC has been identified, indicating this is not yet observed in widespread active campaigns. Despite the absence of in-the-wild data, the attack's minimal prerequisites and decade-wide affected version range - spanning OTP 17.0 onward - mean any operator running inets httpd as a publicly reachable service on an unpatched OTP release faces meaningful real-world exposure. The attack window's breadth suggests many long-running Erlang deployments that track major but not minor OTP releases may be silently affected.

An attacker establishes multiple concurrent TCP connections to the inets httpd listener and sends syntactically valid HTTP request headers on each, declaring a very large Content-Length (e.g., several gigabytes), then transmits no further bytes. Because the request handler cancels its timeout upon successful header parsing and installs no timer for body reading, each stalled connection permanently occupies a worker process. After filling all slots permitted by max_clients in this manner, legitimate requests are refused or time out, achieving full denial of service at negligible bandwidth cost and with no exploit code required beyond a standard TCP client.