Denial of Service Vulnerability in Erlang/OTP inets httpd

CVE-2026-69664

What is CVE-2026-69664?

A missing resource release vulnerability in the Erlang/OTP inets httpd component can lead to a denial of service. An unauthenticated remote attacker can exploit this issue by sending incorrectly formatted requests, causing the server to retain connections indefinitely due to workers becoming occupied. The vulnerability arises when the server improperly handles the chunked transfer encoding, specifically when the chunk size is not in the expected hexadecimal format. This can lead to the exhaustion of available workers, thereby denying legitimate clients access. By default, this issue affects systems without additional configurations.

References