Erlang/OTP httpd Unenforced max_clients Limit DoS (CVE-2025-70399)

Vulnerability Summary: Denial of Service Due to Unenforced Default max_clients Limit in httpd Overview Vulnerability Name: Denial of Service via Unenforced Default max_clients Limit in httpd CVE ID: CVE-2025-70399 Severity: High (CVSS 8.7/10) Description: The httpd server in does not enforce its documented default concurrency limit. The documentation states that defaults to 10 and should take effect immediately upon connection establishment; however, if is not explicitly set, the server actually accepts an unlimited number of concurrent connections. Impact: An unauthenticated attacker can open and hold a large number of connections, exhausting file descriptors and memory, causing service degradation or unavailability. Servers with explicitly configured are not affected. Affected Versions Versions greater than or equal to any fixed version are unaffected; versions matching the affected version expression are affected; all others are unaffected. Note: OTP versions prior to 17.0 are considered unaffected due to undefined version comparison rules. Workarounds 1. Explicitly set (e.g., to 150 or another suitable value); explicitly configured values take effect correctly, thereby restoring the expected limit. 2. Limit the number of concurrent connections at the front-end of the server (e.g., via reverse proxy or firewall rules for connection counts/connection rate). 3. Restrict server access to trusted clients (where deployment permits). PoC / Exploitation Code The page does not include a PoC or exploitation code block.

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP httpd Unenforced max_clients Limit DoS (CVE-2025-70399)

More from this source