CVE-2026-69664 Erlang CVE debrief

Who should care

Defenders responsible for Erlang/OTP and inets httpd deployments should assess exposure and prioritize patching or applying workarounds to prevent potential denial-of-service attacks.

Why it matters

Defenders should care about CVE-2026-69664 because it allows unauthenticated remote attackers to cause denial of service in Erlang/OTP inets httpd, potentially occupying available workers and denying service to legitimate clients. Defenders responsible for Erlang/OTP and inets httpd deployments should assess exposure and prioritize patching or applying workarounds.

• Denial of service to legitimate clients
• Occupation of available workers by repeating requests
• Potential for exploitation by unauthenticated remote attackers
• Verification of exposure and patching priority

Technical summary

The vulnerability allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later,

Defensive priority

Defenders should prioritize verifying exposure and applying patches or workarounds to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify exposure by checking the version of OTP and inets in use
• Apply patches or workarounds to prevent potential denial-of-service attacks
• Monitor for suspicious activity and implement compensating controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability affects OTP from OTP 18.1.4 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.