Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-69664— httpd parks a request worker indefinitely on a malformed chunk size sent after the headers

Quick assessment

Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/OTP是Erlang/OTP团队开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 18.1.4版本至27.3.4.17之前版本、28.0版本至28.5.0.6之前版本和29.0版本至29.0.6之前版本存在资源管理错误漏洞，该漏洞源于对HTTP请求中chunked body的chunk-size行处理不当，导致资源在有效生命周期后未释放，可能允许未经身份验证的远程攻击者通过发送特制请求占用所有可用工作进程，造成拒绝服

CVSS 8.7 · High EPSS 0.95% · P61

Possible ATT&CK Techniques 1 AI

T1047 · Windows Management Instrumentation

Affected Version Matrix 3

VendorProduct Version RangeStatus
Erlang OTP 18.1.4< * affected
6.0.3< * affected
77acb473d8f056f6f534395f131c6e45693797f0< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-69664

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default. This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对已超过有效生命周期的资源丧失索引
Source: CVE Program / CVE List V5
Vulnerability Title
Erlang/OTP 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Erlang/OTP是Erlang/OTP团队开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 18.1.4版本至27.3.4.17之前版本、28.0版本至28.5.0.6之前版本和29.0版本至29.0.6之前版本存在资源管理错误漏洞，该漏洞源于对HTTP请求中chunked body的chunk-size行处理不当，导致资源在有效生命周期后未释放，可能允许未经身份验证的远程攻击者通过发送特制请求占用所有可用工作进程，造成拒绝服
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang OTP 18.1.4 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 6.0.3 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 77acb473d8f056f6f534395f131c6e45693797f0 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-69664

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-69664

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-69664 (4)

Vendor Advisories for CVE-2026-69664 (2)

Other References for CVE-2026-69664 (1)

Same Patch Batch · Erlang · 2026-09-01 · 16 CVEs total

CVE-2026-71380 8.7 HIGH httpd applies no timeout while receiving a request body, parking a worker on a stalled cli
CVE-2026-70399 8.7 HIGH httpd does not enforce the documented default max_clients connection limit
CVE-2026-74835 8.7 HIGH inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
CVE-2026-66357 8.3 HIGH inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
CVE-2026-73812 8.3 HIGH inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
CVE-2026-73276 8.3 HIGH inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
CVE-2026-55951 8.2 HIGH httpc memory exhaustion via unbounded response header accumulation
CVE-2026-75538 8.2 HIGH A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into
CVE-2026-66835 8.2 HIGH httpd mod_auth directory protection bypassed by a doubled slash in the request path
CVE-2026-73270 8.2 HIGH httpd mod_auth directory protection bypassed by request path casing on case-insensitive fi
CVE-2026-59696 6.9 MEDIUM uri_string does not bound the port component of a URI before integer conversion
CVE-2026-71562 6.3 MEDIUM httpc does not bound server-supplied numeric header values before integer conversion
CVE-2026-70405 6.3 MEDIUM snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
CVE-2026-70409 6.3 MEDIUM eldap does not bound the port component of a referral URL before integer conversion
CVE-2026-74994 6.0 MEDIUM inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-772