Denial of Service Vulnerability in Erlang/OTP httpd by Erlang Solutions

CVE-2026-70399

What is CVE-2026-70399?

A resource limitation issue exists in Erlang/OTP's inets httpd that enables unauthenticated remote attackers to initiate a denial of service attack by opening an excessive number of simultaneous connections. By default, the max_clients option is intended to limit connections to 150, providing a first layer of defense against denial of service. However, if this option is not explicitly set, the server may accept an unlimited number of connections, leading to potential exhaustion of server resources. The flaw arises because the server fails to reject additional connections when the limit is not defined, allowing attackers to monopolize system resources without requiring valid requests or authentication. Configured servers that specify a max_clients value are protected from this vulnerability.

References