Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-71562— httpc does not bound server-supplied numeric header values before integer conversion

Quick assessment

Affected
Erlang OTP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Erlang/OTP是Erlang/OTP团队开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 17.0版本至27.3.4.17之前版本、28.0版本至28.5.0.6之前版本和29.0版本至29.0.6之前版本存在输入验证错误漏洞，该漏洞源于对输入中指定数量的验证不当，httpc_handler.erl在比较max_body_size之前使用list_to_integer/1转换服务器提供的Content-Length，未对数值

CVSS 6.3 · Medium EPSS 0.58% · P47

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 9

VendorProduct Version RangeStatus
Erlang OTP < 17.0 unknown
17.0< 27.3.4.17 affected
28.0< 28.5.0.6 affected
29.0< 29.0.6 affected
< 5.10 unknown
5.10< 9.3.2.7 affected
9.4< 9.6.2.3 affected
9.7< 9.7.2 affected
… +1 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-71562

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
httpc does not bound server-supplied numeric header values before integer conversion
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP inets httpc allows a malicious or compromised HTTP server to degrade availability by returning a numeric header whose value is a very long run of digits. httpc_handler.erl converts the server-supplied Content-Length with list_to_integer/1 before comparing it against max_body_size, so the size check cannot protect the conversion, and the option defaults to nolimit in any case. The same unbounded conversion appears in httpc_response:format_response/1 for Content-Length and in httpc_response:get_ms_from_retry_after/1 for Retry-After, which is guarded only by a check that the first character is a digit. A value of up to roughly 1.26 million digits converts successfully and costs the requesting process hundreds of milliseconds of arbitrary-precision arithmetic per response. The conversion function is documented to accept integers of any size, so bounding the input is the caller's responsibility. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1284
Source: CVE Program / CVE List V5
Vulnerability Title
Erlang/OTP 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Erlang/OTP是Erlang/OTP团队开源的一个JavaScript编写的处理处理异常的库。该库可以捕捉node.js内置API引发的异常。 Erlang/OTP 17.0版本至27.3.4.17之前版本、28.0版本至28.5.0.6之前版本和29.0版本至29.0.6之前版本存在输入验证错误漏洞，该漏洞源于对输入中指定数量的验证不当，httpc_handler.erl在比较max_body_size之前使用list_to_integer/1转换服务器提供的Content-Length，未对数值
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Erlang OTP 17.0 ~ 27.3.4.17 cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 5.10 ~ 9.3.2.7 cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
Erlang OTP 84adefa331c4159d432d22840663c38f155cd4c1 ~ * cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-71562

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-71562

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-71562 (3)

Same Patch Batch · Erlang · 2026-09-01 · 16 CVEs total

CVE-2026-71380 8.7 HIGH httpd applies no timeout while receiving a request body, parking a worker on a stalled cli
CVE-2026-70399 8.7 HIGH httpd does not enforce the documented default max_clients connection limit
CVE-2026-74835 8.7 HIGH inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
CVE-2026-69664 8.7 HIGH httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
CVE-2026-66357 8.3 HIGH inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
CVE-2026-73812 8.3 HIGH inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
CVE-2026-73276 8.3 HIGH inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
CVE-2026-55951 8.2 HIGH httpc memory exhaustion via unbounded response header accumulation
CVE-2026-75538 8.2 HIGH A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into
CVE-2026-66835 8.2 HIGH httpd mod_auth directory protection bypassed by a doubled slash in the request path
CVE-2026-73270 8.2 HIGH httpd mod_auth directory protection bypassed by request path casing on case-insensitive fi
CVE-2026-59696 6.9 MEDIUM uri_string does not bound the port component of a URI before integer conversion
CVE-2026-70405 6.3 MEDIUM snmp BER INTEGER decoder applies no size limit to attacker-supplied integer fields
CVE-2026-70409 6.3 MEDIUM eldap does not bound the port component of a referral URL before integer conversion
CVE-2026-74994 6.0 MEDIUM inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

IV. Related Vulnerabilities

Same product: OTP
Same vendor: Erlang
Same weakness: CWE-1284