Improper Validation Vulnerability in Erlang/OTP inets HTTP Client

CVE-2026-71562

What is CVE-2026-71562?

An improper validation issue exists within the Erlang/OTP inets HTTP client, where a malicious HTTP server can exploit the inets httpc module by sending a numeric header that excessively exceeds expected values. The httpc_handler.erl file inadequately processes the Content-Length by using list_to_integer/1 without proper safeguards, which allows for conversion of extremely large integer values—up to approximately 1.26 million digits. This can lead to significant performance degradation, as the requesting process will endure delays of hundreds of milliseconds due to unbounded arbitrary-precision arithmetic for each response. Affected versions of OTP range from 17.0 up to 29.0.6, corresponding to inets versions 5.10 through 9.7.2. This vulnerability poses risks to application availability, which may be exploited by attackers to disrupt service.

References