Erlang/OTP httpc Memory Exhaustion via Unbounded Header Accumulation (CVE-2026-50591)

Vulnerability Overview Vulnerability Name: httpc memory exhaustion (via unbounded header accumulation) CVE ID: CVE-2026-50591 Severity: High (CVSS 8.2 / 10) Description: The HTTP client in Erlang/OTP does not limit the total size of response headers received from a server. A malicious or compromised HTTP server can send an arbitrary number of headers (or headers with oversized values), causing the client process to allocate unbounded memory until system memory exhaustion or BEAM VM crash occurs. Scope of Impact: - Affected versions: , - Fixed versions: (OTP); (inets) - The attack requires no authentication. Any application connecting to an untrusted server is affected; applications connecting only to controlled servers are practically unaffected, but remain technically vulnerable. POC / Exploit Code: - Demonstration: Sending 100,000 headers (each approx. 4000 bytes) within 30 seconds causes the client to allocate 13+ GB of memory, leading to system memory exhaustion. - The page does not provide a copyable POC code block; it only describes the demonstration scenario in text. Fix Details Pre-Fix (Affected Versions): No configuration-based workaround exists; the option is either absent or defaults to , preventing an upper limit from being set. Potential Mitigations: - Restrict to connect only to trusted servers. - Use OS-level memory limits (cgroups, ulimits) to constrain maximum memory usage. - Use an alternative HTTP client library that limits header size. Post-Fix: A new per-request option has been added (default 1024 bytes, calculated cumulatively). Most users do not need to take additional action; the secure default value takes effect automatically.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP httpc Memory Exhaustion via Unbounded Header Accumulation (CVE-2026-50591)

More from this source