Memory Exhaustion Risk in Erlang/OTP HTTP Client

CVE-2026-55951

What is CVE-2026-55951?

The Erlang/OTP httpc HTTP client is vulnerable to memory exhaustion caused by unbounded response headers from compromised servers. By default, the max_header_size option is set to no limit, allowing malicious actors to send a significant number of headers or headers with large values. This leads to excessive memory allocation and potential system crashes. Applications using the httpc:request function to connect to untrusted HTTP servers are particularly at risk, as no authentication is required for this exploit to occur. The issue affects multiple versions of Erlang/OTP, making it essential for users to apply the necessary patches to safeguard their systems.

References