CVE-2026-69664 Erlang CVE debrief

Who should care

Defenders responsible for Erlang/OTP inets httpd deployments, especially those with unauthenticated remote access, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-69664 is a high-severity vulnerability in Erlang/OTP inets httpd that allows unauthenticated remote attackers to cause denial of service. Defenders should prioritize verifying exposure, especially in deployments with unauthenticated remote access, and assess the need for updates or compensating controls to mitigate the vulnerability.

• Denial of service to legitimate clients due to occupied workers
• Potential for resource exhaustion and service degradation
• Need for verification of exposure in Erlang/OTP inets httpd deployments
• Priority for updates or compensating controls to mitigate the vulnerability

Technical summary

The vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause a denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. This causes the worker serving the connection to never be released, occupying every available worker and denying service to legitimate clients. The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed

Defensive priority

Defenders should prioritize verifying exposure in Erlang/OTP inets httpd deployments, especially those with unauthenticated remote access, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify Erlang/OTP inets httpd deployments for exposure, especially those with unauthenticated remote access
• Assess the need for updates to Erlang/OTP versions 18.1.4 to 27.3.4.17, 28.0 to 28.5.0.6, and 29.0 to 29.0.6
• Implement compensating controls, such as rate limiting or monitoring, if updates are not feasible
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd. Official sources include the CVE Program, NIST NVD, and Erlang's security advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.