Erlang HTTP Server max_clients DoS Vulnerability Fix & PoC

Vulnerability Overview This commit ( ) fixes a vulnerability where the HTTP server's default maximum number of client connections (max_clients) was not properly enforced. The documentation specifies that defaults to 150, but the original implementation did not effectively limit the default value, allowing the server to accept an unlimited number of client connections. This creates a risk of resource exhaustion (Denial of Service / DoS). Scope of Impact Affected Components: , , and test files and located under . Affected Behavior: failed to validate the limit when handling new connections, enabling an attacker to exhaust server resources through a large number of concurrent connections. Fix Details 1. : The macro definition remains at (maintaining the default value), and auxiliary definitions such as were added. 2. : - A new logic was introduced to check whether the current number of active connections has reached the limit before establishing a connection. - Auxiliary functions and were introduced to track the current connection count. - When the connection count reaches the limit, new connections are rejected (returning ). 3. Test Updates: New/modified test cases were added to and to verify that the limit is enforced. POC / Key Code Snippets 1. Connection Count Check Logic ( ) 2. Default Value Definition ( ) 3. Test Case ( ) 4. Test Configuration ( ) ```erlang [{group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group,

Goal Reached Thanks to every supporter — we hit 100%!

Erlang HTTP Server max_clients DoS Vulnerability Fix & PoC

More from this source