Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-69664— httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Quick assessment

Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： 资源生命周期结束后未释放（Missing Release of Resource after Effective Lifetime）漏洞 Erlang/OTP 的 模块存在一个“资源生命周期结束后未释放”的漏洞。一个未经身份验证的远程攻击者可以通过发送一个块体（chunked body）请求来触发拒绝服务（DoS），其中块大小行（chunk-size line）不是十六进制数字。处理该连接的 worker 进程永远不会被释放，且没有超时机制将其回收，因此，如果在多个连接上重复发送此请求

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-69664

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对已超过有效生命周期的资源丧失索引
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang OTP 18.1.4 ~ 27.3.4.17 cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 6.0.3 ~ 9.3.2.7 cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 77acb473d8f056f6f534395f131c6e45693797f0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-69664

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-69664

请登录查看更多情报信息。

Other References for CVE-2026-69664 (6)

Same Patch Batch · Erlang · 2026-09-01 · 16 CVEs total

CVE-2026-71380 8.7 HIGH httpd applies no timeout while receiving a request body, parking a worker on a stalled cli
CVE-2026-70399 8.7 HIGH httpd does not enforce the documented default max_clients connection limit
CVE-2026-74835 8.7 HIGH inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
CVE-2026-66357 8.3 HIGH inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
CVE-2026-73812 8.3 HIGH inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
CVE-2026-73276 8.3 HIGH inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
CVE-2026-55951 8.2 HIGH httpc memory exhaustion via unbounded response header accumulation
CVE-2026-75538 8.2 HIGH A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into
CVE-2026-66835 8.2 HIGH httpd mod_auth directory protection bypassed by a doubled slash in the request path
CVE-2026-73270 8.2 HIGH httpd mod_auth directory protection bypassed by request path casing on case-insensitive fi
CVE-2026-59696 6.9 MEDIUM uri_string does not bound the port component of a URI before integer conversion
CVE-2026-71562 6.3 MEDIUM httpc does not bound server-supplied numeric header values before integer conversion
CVE-2026-70405 6.3 MEDIUM snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
CVE-2026-70409 6.3 MEDIUM eldap does not bound the port component of a referral URL before integer conversion
CVE-2026-74994 6.0 MEDIUM inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-772

V. Comments for CVE-2026-69664

No comments yet

Leave a comment