Erlang HTTP Server max_clients DoS Vulnerability Fix & PoC

漏洞概述 该提交（commit ）修复了 HTTP 服务器默认最大客户端连接数（max_clients）未被正确限制 的漏洞。文档中指定 默认为 150，但原实现未对默认值进行有效限制，导致服务器可能接受无限数量的客户端连接，存在资源耗尽（DoS）风险。 影响范围 受影响组件： 下的 、 及测试文件 、 。 影响行为： 在处理新连接时未校验 上限，攻击者可通过大量并发连接耗尽服务器资源。 修复方案 1. ：将 宏定义从 调整为 （保持默认值），并新增 等辅助定义。 2. ： - 新增 逻辑，在连接建立前检查当前活跃连接数是否达到 上限。 - 引入 与 辅助函数，用于统计当前连接数。 - 当连接数达到上限时，拒绝新连接（返回 ）。 3. 测试更新：在 和 中新增/修改测试用例，验证 限制生效。 POC / 关键代码片段 1. 连接数检查逻辑（ ） 2. 默认值定义（ ） 3. 测试用例（ ） 4. 测试配置（ ） ```erlang [{group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {group, httpd_basic}, {

Goal Reached Thanks to every supporter — we hit 100%!

Erlang HTTP Server max_clients DoS Vulnerability Fix & PoC

More from this source