CVE-2026-70399 Erlang CVE debrief

Who should care

Defenders responsible for Erlang/OTP deployments should assess exposure and verify versions to prevent potential denial-of-service attacks. This includes reviewing system configurations, monitoring connection counts, and implementing rate limiting or connection throttling as needed. Additionally, defenders should prioritize verifying and updating their Erlang/OTP versions to prevent potential denial-of-service attacks, and consider implementing compens

Why it matters

CVE-2026-70399 is a high-severity vulnerability in Erlang/OTP inets httpd that allows unauthenticated remote attackers to cause denial of service. Defenders should verify and update their versions, implement rate limiting, and monitor system resources to mitigate potential attacks.

• Denial of service through resource exhaustion
• Potential for process, memory, and file descriptor exhaustion
• Need for verification of Erlang/OTP versions and implementation of rate limiting or connection throttling

Technical summary

The vulnerability is caused by the inets httpd not properly limiting the number of simultaneous connections, allowing an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. This occurs because the max_clients option is not set by default, and the server accepts an unlimited number of connections when this option is not explicitly configured. The issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6.

Defensive priority

Defenders should prioritize verifying and updating their Erlang/OTP versions to prevent potential denial-of-service attacks.

Recommended defensive actions

• Verify and update Erlang/OTP versions to ensure they are within the affected ranges.
• Implement rate limiting or connection throttling to mitigate potential denial-of-service attacks.
• Monitor system resources and connection counts to detect potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and potential impact. The inets httpd vulnerability allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. Servers that do not set max_clients explicitly accept an unlimited number of simultaneous connections. The accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is not

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.