Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-70399— httpd does not enforce the documented default max_clients connection limit

Quick assessment

Affected

Erlang OTP

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/OTP是Erlang/OTP团队开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP inets httpd 17.0至27.3.4.17之前版本、28.0至28.5.0.6之前版本和29.0至29.0.6之前版本存在资源管理错误漏洞，该漏洞源于资源分配无限制或节流不当，max_clients选项未明确设置时服务器接受无限数量的并发连接，可能导致未认证远程攻击者通过打开并保持大量连接造成拒绝服务。

CVSS 8.7 · High EPSS 0.93% · P60 Updated Sep 08, 2026

Possible ATT&CK Techniques 2 AI

T1499 · Endpoint Denial of Service T1499.001 · OS Exhaustion Flood

Affected Version Matrix 7

Vendor	Product	Version Range	Status
Erlang	OTP	`17.0< 27.3.4.17`	affected
		`28.0< 28.5.0.6`	affected
		`29.0< 29.0.6`	affected
		`5.10< 9.3.2.7`	affected
		`9.4< 9.6.2.3`	affected
		`9.7< 9.7.2`	affected
		`d9674f32811cd5bb02b0d6656053b5ee226bc74c< *`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-70399

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

httpd does not enforce the documented default max_clients connection limit

Source: CVE Program / CVE List V5

Vulnerability Description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required. The accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Vulnerability Title

Erlang/OTP 资源管理错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Erlang	OTP	17.0 ~ 27.3.4.17	`cpe:2.3:a:erlang:erlang\/otp::::::::`
Erlang	OTP	5.10 ~ 9.3.2.7	`cpe:2.3:a:erlang:erlang\/otp::::::::`
Erlang	OTP	d9674f32811cd5bb02b0d6656053b5ee226bc74c ~ *	`cpe:2.3:a:erlang:erlang\/otp::::::::`

II. Public POCs for CVE-2026-70399

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-70399

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-70399 (3)

Vendor Advisories for CVE-2026-70399 (3)

🔗 EEF-CVE-2026-70399 - OSV Read full article related
🔗 CVE-2026-70399 Read full article related
🔗 Denial of Service via Unenforced Default max_clients Limit in httpd · Advisory · erlang/otp · GitHub Read full article vendor-advisory related

https://www.cve.org/CVERecord?id=CVE-2026-70399

Same Patch Batch · Erlang · 2026-09-01 · 16 CVEs total

CVE-2026-71380	8.7 HIGH	httpd applies no timeout while receiving a request body, parking a worker on a stalled cli
CVE-2026-74835	8.7 HIGH	inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
CVE-2026-69664	8.7 HIGH	httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
CVE-2026-66357	8.3 HIGH	inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
CVE-2026-73812	8.3 HIGH	inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
CVE-2026-73276	8.3 HIGH	inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
CVE-2026-55951	8.2 HIGH	httpc memory exhaustion via unbounded response header accumulation
CVE-2026-75538	8.2 HIGH	A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into
CVE-2026-66835	8.2 HIGH	httpd mod_auth directory protection bypassed by a doubled slash in the request path
CVE-2026-73270	8.2 HIGH	httpd mod_auth directory protection bypassed by request path casing on case-insensitive fi
CVE-2026-59696	6.9 MEDIUM	uri_string does not bound the port component of a URI before integer conversion
CVE-2026-71562	6.3 MEDIUM	httpc does not bound server-supplied numeric header values before integer conversion
CVE-2026-70405	6.3 MEDIUM	snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
CVE-2026-70409	6.3 MEDIUM	eldap does not bound the port component of a referral URL before integer conversion
CVE-2026-74994	6.0 MEDIUM	inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

IV. Related Vulnerabilities

Same product: OTP

Same vendor: Erlang

Same weakness: CWE-770